EUVD-2026-63091
GHSA-4vrw-8fx2-pj82
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
PR:H reflects the requirement for a registered cluster credential; S:C because cross-cluster data is affected; I:H for tamper/delete of owned data; C:N and A:N as no confidentiality breach or denial of service is described.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.
AnalysisAI
Cross-cluster data integrity violation in Red Hat Advanced Cluster Management for Kubernetes 2 allows a registered and authenticated managed cluster to tamper with or delete indexed search data belonging to other clusters. The flaw resides in the delta-sync write paths of the search-indexer component, which fails to enforce cluster-scoped ownership checks before processing UPDATE and DELETE operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control a cluster that is already registered and authenticated as a managed cluster with the RHACM hub - this maps to CVSS PR:H and is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N yields a score of 6.8, which accurately reflects the attack profile: network-reachable, low complexity once inside, but gated behind High privilege (an authenticated managed cluster registration). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised the credentials or control plane of one registered managed cluster connects to the RHACM hub's search-indexer delta-sync endpoint and submits crafted UPDATE or DELETE payloads containing UIDs prefixed with another cluster's identifier. Because the write path performs no ownership validation, the hub processes these operations and corrupts or erases the victim cluster's indexed resource data. … |
| Remediation | No exact patched version was confirmed in the available input data; the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-76827 should be consulted for the authoritative fix version and errata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today