EUVD-2026-57061
GHSA-crwr-8cwh-w292
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network vector confirmed by Kubernetes API access model; PR:L reflects required specific RHACM channel permissions; S:C captures cross-namespace boundary crossing; C:L/I:L reflect per-Secret scope of unauthorized access.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.
AnalysisAI
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) enables an authenticated low-privileged user holding specific channel-related permissions to read or modify Kubernetes Secrets outside their authorized namespace scope. The CVSS S:C (Changed Scope) metric confirms the flaw crosses namespace trust boundaries - a critical boundary in multi-tenant Kubernetes environments - potentially exposing credentials, service account tokens, or application secrets belonging to other tenants, and enabling privilege escalation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
The affected component, multicloud-operators-channel, is a Kubernetes operator within RHACM 2.x (CPE: cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*) responsible for managing GitOps-style application delivery channels across multi-cluster environments. Kubernetes Secrets are normally namespace-scoped and protected by RBAC; cross-namespace access is explicitly forbidden under standard cluster policy. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the operator allows a user-supplied key or identifier - likely a namespace name or Secret reference - to target resources outside the user's authorized namespace without performing adequate server-side authorization checks. This is a classic Insecure Direct Object Reference (IDOR) pattern applied to Kubernetes resource addressing, where the system trusts the caller-provided namespace field rather than enforcing RBAC boundaries server-side.
RemediationAI
No specific fixed version number is confirmed in the available data; apply any Red Hat-released patch for this CVE as soon as it becomes available via the official advisory at https://access.redhat.com/security/cve/CVE-2026-64927 and monitor https://bugzilla.redhat.com/show_bug.cgi?id=2514229 for resolution status and patch release details. As compensating controls prior to patching, audit and restrict RBAC permissions granted to users who interact with the multicloud-operators-channel operator - specifically, remove channel and subscription management roles from any accounts that do not operationally require them, reducing the pool of users who could trigger the flaw (trade-off: may disrupt legitimate GitOps pipeline workflows). Implement Kubernetes NetworkPolicies and OPA/Gatekeeper admission policies that explicitly deny cross-namespace Secret references as an additional authorization layer (trade-off: requires policy tuning and may block legitimate cross-namespace channel configurations). Review audit logs for anomalous Secret access patterns across namespace boundaries to detect potential exploitation in progress.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bund
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today