EUVD-2026-75948
GHSA-39w5-9x42-rwmr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Managed cluster agent communicates over network to hub API; low privileges (agent identity) required; no user interaction; scope changes to hub namespaces beyond attacker's cluster; confidentiality-only impact on hub Secrets.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.
AnalysisAI
Cross-namespace secret disclosure in Red Hat Advanced Cluster Management for Kubernetes allows a managed-cluster agent holding low privileges to craft configuration references that point to hub Secrets outside its authorized namespace, delivering those Secrets to an attacker-controlled managed cluster. The vulnerability resides in the multicluster-observability-addon component, which previously processed ManagedClusterAddOn.status.configReferences and fetched referenced objects before enforcing any namespace boundary, allowing cross-cluster credential theft from the hub. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a managed-cluster agent identity (PR:L per CVSS) with write access to ManagedClusterAddOn.status.configReferences on the hub, or control over the managed cluster agent process that sets those references. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 with S:C and C:H accurately captures a lateral-movement threat: once a managed cluster is compromised, the adversary can pivot to harvest hub-level Secrets containing credentials for other clusters or shared infrastructure, multiplying the blast radius well beyond the initially compromised endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream code fix is available in PR #644 at https://github.com/stolostron/multicluster-observability-addon/pull/644, which adds the ValidateConfigNamespaces() function to reject configReferences pointing outside the allowed namespaces before any manifest generation occurs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your ACM deployments for managed cluster agents and verify privilege levels are restricted to minimum necessary; review recent configReferences logs for suspicious cross-namespace references. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bund
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today