Vulnerability · Published Sep 18, 2026 · Assigned by redhat

CVE-2026-93685Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

Medium 5.4

In plain English

A medium-severity information exposure in Red Hat Advanced Cluster Management for Kubernetes 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 61.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	see references
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	see references

Weakness: CWE-200 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

References

https://access.redhat.com/security/cve/CVE-2026-93685 vdb-entry, x_refsource_REDHAT
RHBZ#2518377 issue-tracking, x_refsource_REDHAT