Description (CNA)
A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 | unaffected 1787263584 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13 | unaffected 1787263693 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected 1787170830 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.15 | unaffected 1787240030 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16 | unaffected 1787242321 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17 | unaffected 1787242108 before * |
CWE
CWE-639
References
- https://access.redhat.com/errata/RHSA-2026:60386
- https://access.redhat.com/errata/RHSA-2026:60387
- https://access.redhat.com/errata/RHSA-2026:60388
- https://access.redhat.com/errata/RHSA-2026:60389
- https://access.redhat.com/errata/RHSA-2026:60390
- https://access.redhat.com/errata/RHSA-2026:60391
- https://access.redhat.com/security/cve/CVE-2026-66878
- https://bugzilla.redhat.com/show_bug.cgi?id=2514226
ADP enrichment
No English description supplied.
No references supplied.