{"id":"CVE-2026-89060","aliases":["EUVD-2026-75948","GHSA-39w5-9x42-rwmr"],"status":"published","title":"Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references","description":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00475,"percentile":0.41377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-551"],"published":"2026-09-11T04:22:47Z","modified":"2026-10-28T02:31:01Z","products":[{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.13"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.16"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.17"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:67539","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67540","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67541","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67542","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67543","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89060","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531596","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/stolostron/multicluster-observability-addon/pull/644","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89060","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-39w5-9x42-rwmr"},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89060.json","tags":["advisory"]},{"url":"https://github.com/stolostron/multicluster-observability-addon","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-89060","title":"Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references","description":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.","status":"published","published":"2026-09-11T04:22:47.524Z","modified":"2026-09-21T11:22:19.529Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-551"],"updated_at":"2026-11-02T14:19:55.526923Z"}],"euvd":[{"id":"EUVD-2026-75948","description":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.","status":"published","published":"2026-09-11T04:22:47Z","modified":"2026-09-21T11:22:19Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:05.72344Z"}],"ghsa":[{"id":"GHSA-39w5-9x42-rwmr","title":"A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster...","description":"A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.","status":"published","published":"2026-09-11T06:31:14Z","modified":"2026-09-21T12:33:41Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-551"],"updated_at":"2026-11-02T15:12:14.750064Z"}],"nvd":[{"id":"CVE-2026-89060","description":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.","status":"published","published":"2026-09-11T05:16:38.557Z","modified":"2026-09-21T12:17:23.503Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-551"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"CVE-2026-89060","title":"Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references","description":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.","status":"published","published":"2026-09-11T04:22:47.524Z","modified":"2026-10-28T02:31:01.100276612Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-551"],"updated_at":"2026-11-02T15:45:19.210277Z"}]}}