Description
A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.
Published: 2026-08-12
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the multicloud-operators-channel component allows a user with certain permissions to unintentionally manipulate how the system handles Secrets across different namespaces. By exploiting this confusing deputy weakness (CWE-639), an attacker can alter sensitive information in unauthorized areas, potentially gaining access to confidential data or elevating privileges within the cluster.

Affected Systems

The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes 2. Specific affected versions are not listed; users should check the vendor’s advisories for applicable releases.

Risk and Exploitability

The CVSS score of 6.4 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires the ability to create or modify a Channel resource with a spec.secretref.namespace pointing to a target namespace, so attackers need a sufficient level of access within Red Hat Advanced Cluster Management to initiate the attack path.

Generated by OpenCVE AI on August 12, 2026 at 14:40 UTC.

Remediation

Vendor Workaround

Restrict the creation of `Channel` resources to trusted administrators within Red Hat Advanced Cluster Management. This limits the attack surface by preventing unauthorized tenants from exploiting the confused deputy vulnerability in the `multicloud-operators-channel` component.

OpenCVE Recommended Actions

  • Restrict the creation of Channel resources to trusted administrators within Red Hat Advanced Cluster Management, limiting the attack surface by preventing unauthorized tenants from exploiting the confused deputy flaw.
  • Apply the latest security patch or upgrade to a version of Red Hat Advanced Cluster Management for Kubernetes 2 that resolves the issue once it becomes available.
  • Audit and monitor the creation of Channel resources and cross‑namespace secret changes to detect unauthorized activity promptly.
  • Review and enforce least‑privilege RBAC policies so that users cannot modify Channel resources that could point to other namespaces.

Generated by OpenCVE AI on August 12, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References

Wed, 26 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References

Thu, 13 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Wed, 12 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 12 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.
Title Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy
First Time appeared Redhat
Redhat acm
Weaknesses CWE-639
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-27T02:20:29.616Z

Reserved: 2026-08-11T17:40:07.973Z

Link: CVE-2026-64927

cve-icon Vulnrichment

Updated: 2026-08-12T15:08:55.585Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T02:16:37.780

Modified: 2026-08-27T04:16:44.953

Link: CVE-2026-64927

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-11T00:00:00Z

Links: CVE-2026-64927 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T13:20:24Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key