What is the CVSS score of EUVD-2026-57060?

EUVD-2026-57060 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 21.0%.

Which versions of Red Hat ACM are affected by EUVD-2026-57060?

Red Hat Advanced Cluster Management for Kubernetes 2 contains a privilege escalation vulnerability allowing compromised managed cluster agents to read Secrets and ConfigMaps across all tenant…

How to fix or mitigate EUVD-2026-57060?

Within 24 hours, audit all Red Hat Advanced Cluster Management for Kubernetes 2 deployments to identify multi-tenant configurations and assess managed cluster compromise exposure; document all cluster agents and validate their security baseline. Within 7 days, implement enhanced RBAC policies restricting cross-namespace Secret and ConfigMap access within Channel namespaces, enable audit logging for all Secret and ConfigMap read operations, and evaluate network segmentation to limit hub cluster reachability from managed clusters. Within 30 days, monitor Red Hat security advisories for patch availability on CVE-2026-73122; rotate all Git and Helm repository credentials as a precautionary measure; audit Secret and ConfigMap access logs to detect unauthorized access during the exposure window; and develop an upgrade plan to patched RHACM versions once released.

Red Hat ACM EUVD-2026-57060

| CVE-2026-73122 HIGH

Improper Privilege Management (CWE-269)

2026-08-12 redhat

GHSA-5rf6-jwvg-8r55

Authentication Bypass Privilege Escalation Information Disclosure Red Hat Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

7.7

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

PR:L reflects the required compromised agent credential; S:C captures pivot from managed cluster to hub; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

7.7 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 02:02 vuln.today

CVE Published

Aug 12, 2026 - 01:10 cve.org

HIGH 7.7

DescriptionCVE.org

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure.

AnalysisAI

Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.

Technical ContextAI

Red Hat Advanced Cluster Management for Kubernetes 2 (CPE: cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*:*:*:*:*:*:*:*) uses the multicloud-operators-channel operator on the hub cluster to manage subscription channels that distribute Kubernetes resources - including Secrets and ConfigMaps holding Git and Helm repository credentials - to managed clusters. The root cause is CWE-269 (Improper Privilege Management): the managed cluster agent's RBAC permissions on the hub are not properly scoped to its own Channel namespace, permitting reads across all Channel namespaces. This is an intra-cluster privilege escalation on the hub triggered remotely from the managed cluster's network path to the hub API server.

RemediationAI

Apply the Red Hat-supplied patch for RHACM 2.x as detailed in the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-73122; a specific patched version number is not confirmed in the available data and must be verified directly from that advisory before deployment. As an interim compensating control, audit and tighten Kubernetes RBAC on the hub cluster to ensure managed cluster service accounts and agents are restricted to their designated Channel namespaces only, preventing cross-namespace reads of Secrets and ConfigMaps - note that this requires careful RBAC review to avoid disrupting legitimate channel subscription operations. Enable hub cluster audit logging for Secret and ConfigMap read events from managed cluster service accounts to detect any unauthorized access that may already have occurred. Rotate Git and Helm repository credentials stored in Channel namespace Secrets if unauthorized access cannot be definitively ruled out, accepting the operational cost of re-distributing updated credentials to all subscribers. Do not rely solely on network-layer controls, as the managed cluster agent's connection to the hub API server is an expected and required communication path.