Description
A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.
Published: 2026-08-19
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in volsync-addon-controller, where annotation values are rendered into YAML templates without proper escaping. This flaw enables an attacker to inject malicious YAML code into the OpenShift Lifecycle Manager Subscription resource. The injection can alter subscription configurations, potentially granting unauthorized control over software management processes within the cluster.

Affected Systems

The affected system is Red Hat Advanced Cluster Management for Kubernetes version 2. The flaw occurs when the volsync‑addon‑deploy‑type annotation is explicitly set to olm.

Risk and Exploitability

The CVSS score of 6.2 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires access to the cluster to supply the malicious annotation, meaning exploitation would be limited to insider or compromised credentials. Despite the moderate score, the potential to subvert OLM subscription management warrants timely mitigation.

Generated by OpenCVE AI on August 20, 2026 at 13:03 UTC.

Remediation

Vendor Workaround

To mitigate this vulnerability, ensure that the `volsync-addon-deploy-type` annotation is not explicitly set to `olm`. The default Helm deployment type for volsync-addon-controller in Red Hat Advanced Cluster Management for Kubernetes (since ACM 2.13) is not affected by this flaw.

OpenCVE Recommended Actions

  • Ensure that the volsync-addon-deploy-type annotation is not set to 'olm'; omit the annotation or use the default Helm deployment type.
  • Check for and apply any vendor update or patch that addresses the YAML injection flaw in volsync-addon-controller.
  • Enable audit logging for OLM Subscription objects and monitor for unexpected changes to detect exploitation attempts.

Generated by OpenCVE AI on August 20, 2026 at 13:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References

Wed, 26 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References

Fri, 21 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.
Title Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription
First Time appeared Redhat
Redhat acm
Weaknesses CWE-94
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-08T21:23:22.566Z

Reserved: 2026-08-04T17:21:18.911Z

Link: CVE-2026-18874

cve-icon Vulnrichment

Updated: 2026-08-19T19:54:09.547Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-19T18:16:36.080

Modified: 2026-09-08T22:17:42.310

Link: CVE-2026-18874

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-19T17:00:00Z

Links: CVE-2026-18874 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:45:03Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')