Skip to contentRed Hat Advanced Cluster Management For Kubernetes 2 vulnerabilities
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +17 more +19 moreAnsible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rceCVE-2026-84503Fix available6.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +12 more +14 moreAnsible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)CVE-2026-1230376.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for containers, migration toolkit for virtualization +12 more +14 moreAnsible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionCVE-2026-929828.5 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +15 more +17 moreAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionCVE-2026-89091Fix available8.8 High
- red hat advanced cluster management for kubernetes 2Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)CVE-2026-936855.4 Medium
- red hat advanced cluster management for kubernetes 2, edge manager 1.2, edge manager 1.3 +2 more +4 moreFlightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleedCVE-2026-926156.6 Medium
- red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14, advanced cluster management for kubernetes 2.15 +2 more +4 moreStolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration referencesCVE-2026-890607.7 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnetsCVE-2026-667869.1 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespaceCVE-2026-731377.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restrictionCVE-2026-675679.9 Critical
- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker labelCVE-2026-667889.9 Critical
- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addressesCVE-2026-667878.7 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijackCVE-2026-667858.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreSearch-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)CVE-2026-768276.8 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentialsCVE-2026-761398.0 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSearch-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestworkCVE-2026-704969.9 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreVolsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscriptionCVE-2026-188746.2 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating saCVE-2026-714709.1 Critical
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSubmariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosityCVE-2026-667806.5 Medium
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner-operator: release workflow consumes same-org composite action via mutable @devel branch refCVE-2026-667834.4 Medium
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner-operator: operator clusterrole grants cluster-wide create/update on all configmapsCVE-2026-667825.8 Medium
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSubmariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationCVE-2026-667815.4 Medium
- red hat multicluster engine for kubernetes, advanced cluster management for kubernetes 2 +1 moreManaged-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approvalCVE-2026-759248.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMust-gather: /tmp/kubeconfig retentionCVE-2026-754855.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMust-gather: must-gather: embedded secret data in acm wrapper crs collected without redactionCVE-2026-738345.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreGovernance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spokeCVE-2026-667938.8 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_memCVE-2026-714729.1 Critical
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSearch-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:mastersCVE-2026-704958.8 High
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +9 more +11 moreMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersCVE-2026-667929.9 Critical
- redhat insights-client, red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +5 more +7 moreInsights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilegeCVE-2026-718466.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dosCVE-2026-714697.5 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container imageCVE-2026-714719.0 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spokeCVE-2026-714738.5 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)CVE-2026-725089.9 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputyCVE-2026-649276.4 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespacesCVE-2026-731227.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltrationCVE-2026-668787.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespaceCVE-2026-703989.6 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotationCVE-2026-725269.9 Critical
- redhat insights-client, red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +5 more +7 moreInsights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx responseCVE-2026-714747.1 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cacheCVE-2026-714685.3 Medium
- redhat insights-client, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +4 more +6 moreInsights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url pathCVE-2026-714756.8 Medium
- redhat insights-client, red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +5 more +7 moreInsights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()CVE-2026-718456.3 Medium
- red hat advanced cluster management for kubernetes 2.17Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofingCVE-2026-714677.5 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscriptionCVE-2026-100909.0 Critical
- red hat logging subsystem for red hat openshift, multicluster engine for kubernetes, multicluster engine for kubernetes 2.1 +17 more +19 moreHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesCVE-2026-162429.4 Critical
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- openssl, red hat cost management 4, multicluster engine for kubernetes +23 more +25 moreHeap Use-After-Free in the PKCS7_verify() FunctionCVE-2026-45447Public exploitFix available8.8 High
- rclone, red hat cryostat 4, openshift api for data protection +1 more +3 moreRclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixCVE-2026-49980Fix available9.8 Critical
- Show moreLoading…