Description
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes allows an attacker who can annotate the namespaced ManagedClusterAddOn resource to override the governance-policy container image. The overridden image can be a controlled payload executed with cluster‑admin privileges on the managed cluster, enabling arbitrary code execution and privilege escalation. The weakness is an instance of improper input validation (CWE‑20).

Affected Systems

Red Hat Advanced Cluster Management for Kubernetes version 2 is affected by this vulnerability.

Risk and Exploitability

The vulnerability carries a high CVSS score of 8.8, indicating a severe impact. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. An attacker must have the ability to annotate ManagedClusterAddOn resources in the hub cluster; with that privilege, they can modify the image used by the governance‑policy component on any bound web‑infrastructure spoke, effectively executing arbitrary code within that cluster. The risk is greatest when unauthorized users or compromised accounts acquire annotation permissions, which is why restricting and auditing those permissions is critical.

Generated by OpenCVE AI on August 18, 2026 at 16:58 UTC.

Remediation

Vendor Workaround

To mitigate this issue, restrict users' ability to annotate ManagedClusterAddOn resources within the hub cluster. Ensure that only trusted administrators have namespace-level annotate permissions on these resources. Regularly review and audit permissions related to ManagedClusterAddOn resources to prevent unauthorized modifications. If a service is restarted or reloaded, these permission changes will persist.

OpenCVE Recommended Actions

  • Restrict users’ ability to annotate ManagedClusterAddOn resources to trusted administrators within the hub cluster.
  • Regularly review and audit the namespace‑level annotate permissions for ManagedClusterAddOn resources to ensure only authorized users have access.
  • Persistently enforce the permission restrictions, noting that the changes survive service restarts or reloads.
  • If an official patch becomes available, apply it to eliminate the vulnerability entirely.

Generated by OpenCVE AI on August 18, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 18 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.
Title Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke
First Time appeared Redhat
Redhat acm
Weaknesses CWE-20
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-05T14:23:37.148Z

Reserved: 2026-07-27T17:51:24.886Z

Link: CVE-2026-66793

cve-icon Vulnrichment

Updated: 2026-08-18T17:59:38.883Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-18T15:17:00.140

Modified: 2026-08-27T04:16:46.047

Link: CVE-2026-66793

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-18T14:25:00Z

Links: CVE-2026-66793 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:18:43Z

Weaknesses
  • CWE-20

    Improper Input Validation