Advisories · Technology

Red Hat Advanced Cluster Management for Kubernetes 2.16.

Every CVE that names Red Hat Advanced Cluster Management for Kubernetes 2.16 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-89060 CVE record

CVSS 7.7 High

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- CWE-551
Not analysed yet 11 Sept 2026
CVE-2026-66786 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- Code injection
Not analysed yet 2 Sept 2026
CVE-2026-73137 CVE record

CVSS 7.7 High

Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Information disclosure
Not analysed yet 20 Aug 2026
CVE-2026-67567 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-441
Not analysed yet 20 Aug 2026
CVE-2026-66788 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- CWE-1104
Not analysed yet 20 Aug 2026
CVE-2026-66787 CVE record

CVSS 8.7 High

Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- CWE-345
Not analysed yet 20 Aug 2026
CVE-2026-66785 CVE record

CVSS 8.7 High

Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- CWE-345
Not analysed yet 20 Aug 2026
CVE-2026-76827 CVE record

CVSS 6.8 Medium

Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-693
Not analysed yet 19 Aug 2026
CVE-2026-76139 CVE record

CVSS 8.0 High

Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-829
Not analysed yet 19 Aug 2026
CVE-2026-70496 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Privilege escalation
Not analysed yet 19 Aug 2026
CVE-2026-18874 CVE record

CVSS 6.2 Medium

Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Code injection
Not analysed yet 19 Aug 2026
CVE-2026-71470 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-913
Not analysed yet 19 Aug 2026
CVE-2026-66780 CVE record

CVSS 6.5 Medium

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-66783 CVE record

CVSS 4.4 Medium

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- CWE-1357
Not analysed yet 18 Aug 2026
CVE-2026-66782 CVE record

CVSS 5.8 Medium

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-66781 CVE record

CVSS 5.4 Medium

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-749
Not analysed yet 18 Aug 2026
CVE-2026-75485 CVE record

CVSS 5.5 Medium

Must-gather: /tmp/kubeconfig retention
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-73834 CVE record

CVSS 5.5 Medium

Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-66793 CVE record

CVSS 8.8 High

Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-20
Not analysed yet 18 Aug 2026
CVE-2026-71472 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Command injection
Not analysed yet 17 Aug 2026
CVE-2026-70495 CVE record

CVSS 8.8 High

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Privilege escalation
Not analysed yet 17 Aug 2026
CVE-2026-66792 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters
- Red Hat Multicluster Global Hub 1.4.9
- Red Hat Multicluster Global Hub 1.5.8
- Broken access control
Not analysed yet 17 Aug 2026
CVE-2026-71846 CVE record

CVSS 6.5 Medium

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Privilege escalation
Not analysed yet 12 Aug 2026
CVE-2026-71469 CVE record

CVSS 7.5 High

Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Denial of service
Not analysed yet 12 Aug 2026
CVE-2026-71471 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-829
Not analysed yet 12 Aug 2026
CVE-2026-71473 CVE record

CVSS 8.5 High

Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-72508 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Privilege escalation
Not analysed yet 12 Aug 2026
CVE-2026-64927 CVE record

CVSS 6.4 Medium

Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-73122 CVE record

CVSS 7.7 High

Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Privilege escalation
Not analysed yet 12 Aug 2026
CVE-2026-66878 CVE record

CVSS 7.7 High

Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-70398 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-441
Not analysed yet 12 Aug 2026
CVE-2026-72526 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- CWE-441
Not analysed yet 12 Aug 2026
CVE-2026-71474 CVE record

CVSS 7.1 High

Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Information disclosure
Not analysed yet 11 Aug 2026
CVE-2026-71468 CVE record

CVSS 5.3 Medium

Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Privilege escalation
Not analysed yet 11 Aug 2026
CVE-2026-71475 CVE record

CVSS 6.8 Medium

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Path traversal
Not analysed yet 11 Aug 2026
CVE-2026-71845 CVE record

CVSS 6.3 Medium

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Information disclosure
Not analysed yet 11 Aug 2026
CVE-2026-10090 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Privilege escalation
Not analysed yet 5 Aug 2026