CVE-2026-89060 | BDVDB-2026-371813 Detail
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13
Description#
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
References#
- https://access.redhat.com/errata/RHSA-2026:67539
- https://access.redhat.com/errata/RHSA-2026:67540
- https://access.redhat.com/errata/RHSA-2026:67541
- https://access.redhat.com/errata/RHSA-2026:67542
- https://access.redhat.com/errata/RHSA-2026:67543
- https://access.redhat.com/security/cve/CVE-2026-89060
- https://bugzilla.redhat.com/show_bug.cgi?id=2531596
- https://github.com/stolostron/multicluster-observability-addon/pull/644
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.