Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

• CVE-2026-89060 High 7.7 Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references 0.5%
• CVE-2026-73137 High 7.7 Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace 0.5%
• CVE-2026-67567 Critical 9.9 Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction 0.6%
• CVE-2026-76827 Medium 6.8 Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering) 0.5%
• CVE-2026-76139 High 8.0 Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials 0.7%
• CVE-2026-70496 Critical 9.9 Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork 0.6%
• CVE-2026-18874 Medium 6.2 Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription 0.5%
• CVE-2026-71470 Critical 9.1 Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa 0.7%
• CVE-2026-66780 Medium 6.5 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity 0.6%
• CVE-2026-66781 Medium 5.4 Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication 0.4%
• CVE-2026-75485 Medium 5.5 Must-gather: /tmp/kubeconfig retention 0.2%
• CVE-2026-73834 Medium 5.5 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction 0.1%
• CVE-2026-66793 High 8.8 Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke 0.8%
• CVE-2026-71472 Critical 9.1 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem 0.9%
• CVE-2026-70495 High 8.8 Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters 0.2%
• CVE-2026-66792 Critical 9.9 Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters 0.7%
• CVE-2026-71846 Medium 6.5 Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege 0.2%
• CVE-2026-71469 High 7.5 Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos 0.7%
• CVE-2026-71471 Critical 9.0 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image 1.2%
• CVE-2026-71473 High 8.5 Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke 0.5%
• CVE-2026-72508 Critical 9.9 Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*) 0.8%
• CVE-2026-64927 Medium 6.4 Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy 0.3%
• CVE-2026-73122 High 7.7 Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces 0.5%
• CVE-2026-66878 High 7.7 Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration 0.5%
• CVE-2026-70398 Critical 9.6 Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace 0.5%
• CVE-2026-72526 Critical 9.9 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation 0.7%
• CVE-2026-71474 High 7.1 Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response 0.2%
• CVE-2026-71468 Medium 5.3 Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache 0.4%
• CVE-2026-71475 Medium 6.8 Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path 0.7%
• CVE-2026-71845 Medium 6.3 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault() 0.5%
• CVE-2026-10090 Critical 9.0 Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription 0.6%