CVE-2026-93685 — Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint v…

CVE-2026-93685

Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering) PUBLISHED

Description (CNA)

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2	unknown
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2	affected

CWE

CWE-200

References

https://access.redhat.com/security/cve/CVE-2026-93685
https://bugzilla.redhat.com/show_bug.cgi?id=2518377

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.