CVE-2026-18874

Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

View on CVE.org

Published Aug 19, 2026 CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.

Analysis

Technical impact

The vulnerability resides in volsync-addon-controller, where annotation values are rendered into YAML templates without proper escaping. This flaw enables an attacker to inject malicious YAML code into the OpenShift Lifecycle Manager Subscription resource. The injection can alter subscription configurations, potentially granting unauthorized control over software management processes within the cluster.

Affected Systems

The affected system is Red Hat Advanced Cluster Management for Kubernetes version 2. The flaw occurs when the volsync‑addon‑deploy‑type annotation is explicitly set to olm.

Risk and Exploitability

The CVSS score of 6.2 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires access to the cluster to supply the malicious annotation, meaning exploitation would be limited to insider or compromised credentials. Despite the moderate score, the potential to subvert OLM subscription management warrants timely mitigation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.11

affected

Version	Status	Constraints
`1787683560`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.13

affected

Version	Status	Constraints
`1787266564`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.14

affected

Version	Status	Constraints
`1787266564`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.15

affected

Version	Status	Constraints
`1787266360`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.16

affected

Version	Status	Constraints
`1787266564`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.17

affected

Version	Status	Constraints
`1787266556`	unaffected	< *

No data.

Vendor Product Versions

Redhat

Advanced Cluster Management For Kubernetes

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

To mitigate this vulnerability, ensure that the `volsync-addon-deploy-type` annotation is not explicitly set to `olm`. The default Helm deployment type for volsync-addon-controller in Red Hat Advanced Cluster Management for Kubernetes (since ACM 2.13) is not affected by this flaw.

OpenCVE Recommended Actions

Ensure that the volsync-addon-deploy-type annotation is not set to 'olm'; omit the annotation or use the default Helm deployment type.
Check for and apply any vendor update or patch that addresses the YAML injection flaw in volsync-addon-controller.
Enable audit logging for OLM Subscription objects and monitor for unexpected changes to detect exploitation attempts.

Generated by OpenCVE AI on August 20, 2026 at 13:03 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.538% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:60386
https://access.redhat.com/errata/RHSA-2026:60387
https://access.redhat.com/errata/RHSA-2026:60388
https://access.redhat.com/errata/RHSA-2026:60389
https://access.redhat.com/errata/RHSA-2026:60390
https://access.redhat.com/errata/RHSA-2026:60391
https://access.redhat.com/security/cve/CVE-2026-18874
https://bugzilla.redhat.com/show_bug.cgi?id=2511115
https://nvd.nist.gov/vuln/detail/CVE-2026-18874
https://www.cve.org/CVERecord?id=CVE-2026-18874

History

Aug 27, 2026 4:00 AM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:acm:2.11::el9 cpe:/a:redhat:acm:2.14::el9 cpe:/a:redhat:acm:2.16::el9
References		https://access.redhat.com/errata/RHSA-2026:60387 https://access.redhat.com/errata/RHSA-2026:60388 https://access.redhat.com/errata/RHSA-2026:60391

Aug 26, 2026 11:15 PM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:acm:2~~	cpe:/a:redhat:acm:2.13::el9 cpe:/a:redhat:acm:2.15::el9 cpe:/a:redhat:acm:2.17::el9
References		https://access.redhat.com/errata/RHSA-2026:60386 https://access.redhat.com/errata/RHSA-2026:60389 https://access.redhat.com/errata/RHSA-2026:60390

Aug 21, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat advanced Cluster Management For Kubernetes
Vendors & Products		Redhat advanced Cluster Management For Kubernetes

Aug 20, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-18874 https://www.cve.org/CVERecord?id=CVE-2026-18874
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 19, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 19, 2026 6:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.
Title		Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription
First Time appeared		Redhat Redhat acm
Weaknesses		CWE-94
CPEs		cpe:/a:redhat:acm:2
Vendors & Products		Redhat Redhat acm
References		https://access.redhat.com/security/cve/CVE-2026-18874 https://bugzilla.redhat.com/show_bug.cgi?id=2511115
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H'}`