# Red Hat Advanced Cluster Management for Kubernetes 2.

Every CVE that names Red Hat Advanced Cluster Management for Kubernetes 2 among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection](https://agentprime.io/advisories/CVE-2026-92982.md)
  `CVE-2026-92982` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 and 4 more · CVSS 8.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Code injection
- [Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution](https://agentprime.io/advisories/CVE-2026-89091.md)
  `CVE-2026-89091` · CVE record: Red Hat Migration Toolkit for Applications 8 and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)](https://agentprime.io/advisories/CVE-2026-93685.md)
  `CVE-2026-93685` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure
- [Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed](https://agentprime.io/advisories/CVE-2026-92615.md)
  `CVE-2026-92615` · CVE record: Red Hat RHEM 1.2 for RHEL 10 and 3 more · CVSS 6.6 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-413
- [Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets](https://agentprime.io/advisories/CVE-2026-66786.md)
  `CVE-2026-66786` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack](https://agentprime.io/advisories/CVE-2026-66785.md)
  `CVE-2026-66785` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 2 more · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-345
- [Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork](https://agentprime.io/advisories/CVE-2026-70496.md)
  `CVE-2026-70496` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Privilege escalation
- [Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity](https://agentprime.io/advisories/CVE-2026-66780.md)
  `CVE-2026-66780` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Information disclosure
- [Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref](https://agentprime.io/advisories/CVE-2026-66783.md)
  `CVE-2026-66783` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 2 more · CVSS 4.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1357
- [Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps](https://agentprime.io/advisories/CVE-2026-66782.md)
  `CVE-2026-66782` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 2 more · CVSS 5.8 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication](https://agentprime.io/advisories/CVE-2026-66781.md)
  `CVE-2026-66781` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-749
- [Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval](https://agentprime.io/advisories/CVE-2026-75924.md)
  `CVE-2026-75924` · CVE record: Red Hat Multicluster Engine for Kubernetes and 1 more · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Privilege escalation
- [Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters](https://agentprime.io/advisories/CVE-2026-70495.md)
  `CVE-2026-70495` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 8.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Privilege escalation
- [Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters](https://agentprime.io/advisories/CVE-2026-66792.md)
  `CVE-2026-66792` · CVE record: Red Hat Multicluster Global Hub 1.4.9 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control
- [Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates](https://agentprime.io/advisories/CVE-2026-16242.md)
  `CVE-2026-16242` · CVE record: Red Hat multicluster engine for Kubernetes 2.1 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Authentication bypass
- [Nx: nx/devkit: malicious versions of nx and plugins published to npm](https://agentprime.io/advisories/CVE-2025-10894.md)
  `CVE-2025-10894` · CVE record: Red Hat Multicluster Global Hub and 3 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2025 · Tags: CWE-506
- [Openshift api admission checks does not enforce "custom-host" permissions](https://agentprime.io/advisories/CVE-2022-3248.md)
  `CVE-2022-3248` · CVE record: kubernetes and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 5 Oct 2023 · Tags: Broken access control
- [Ocp & fips mode](https://agentprime.io/advisories/CVE-2023-3089.md)
  `CVE-2023-3089` · CVE record: openshift and 4 more · CVSS 7.0 High · Not analysed yet · Published 5 Jul 2023 · Tags: CWE-693

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=red-hat-advanced-cluster-management-for-kubernetes-2>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/red-hat-advanced-cluster-management-for-kubernetes-2/>. Everything for agents: <https://agentprime.io/llms.txt>.