EUVD-2026-61044
GHSA-9h7q-h45w-4hxq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
PR:H reflects that exploiting the ClusterRole requires prior control of the addon-manager pod; S:C because the RBAC permissions extend impact cluster-wide beyond the compromised pod; A:N because no availability impact is described.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.
AnalysisAI
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires prior compromise of the addon-manager pod within a Red Hat Advanced Cluster Management for Kubernetes 2 deployment (mapped to PR:H in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.7 score is justified by the scope change and dual C:H/I:H impact, but the PR:H metric is the critical mitigating factor - an attacker must first achieve code execution inside the addon-manager pod before any of the overprivileged RBAC permissions can be abused. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who achieves code execution within the addon-manager pod - for example by exploiting a vulnerability in the addon-manager process or via a compromised container image - issues Kubernetes API calls using the pod's mounted service account token. They enumerate and exfiltrate Secrets across all namespaces (extracting credentials, API tokens, and TLS keys), then craft and submit a CSR for a synthetic identity with cluster-admin group membership, which they approve using the same overprivileged ClusterRole, obtaining a valid cluster certificate for unrestricted lateral movement. |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-75924 for the vendor-released patched version of RHACM 2; a specific fix version is not confirmed in the available data so none is cited here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Red Hat Advanced Cluster Management for Kubernetes 2 addon-manager ClusterRole bindings to verify current permissions and identify any unauthorized access attempts in audit logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today