Description
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects.
Published: 2026-08-12
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the multicloud-integration component of Red Hat Advanced Cluster Management for Kubernetes 2 lets an authenticated tenant manipulate the GitOpsCluster controller. By doing so, the tenant can redirect bearer tokens that are normally stored in secure locations to a namespace under the tenant’s control. This allows the tenant to read sensitive tokens that authenticate to spoke clusters, potentially revealing critical information and bypassing ArgoCD AppProject security policies. The weakness is a form of credential or token storage mismanagement (CWE-441).

Affected Systems

The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes version 2. No other vendors or products are listed as affected.

Risk and Exploitability

The attacker’s primary vector is an authenticated tenant acting inside the cluster, manipulating the GitOpsCluster controller to redirect bearer tokens. The vulnerability’s impact is unauthorized disclosure of tokens that can authenticate to spoke clusters. The CVSS score of 9.6 reflects a severe threat, yet the EPSS score of <1% indicates a very low likelihood of exploitation. Although the CVE is not listed in the CISA KEV catalog, the weakness still requires remediation.

Generated by OpenCVE AI on August 12, 2026 at 15:03 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Upgrade Red Hat Advanced Cluster Management for Kubernetes to the latest patched version as soon as a vendor fix is available.
  • Restrict tenant permissions to prevent manipulation of the GitOpsCluster controller; enforce least‑privilege role bindings.
  • Monitor namespace creation and token usage for anomalous activity and enforce namespace security policies to isolate sensitive tokens.

Generated by OpenCVE AI on August 12, 2026 at 15:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References

Thu, 13 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Wed, 12 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Critical

Wed, 12 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects.
Title Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace
First Time appeared Redhat
Redhat acm
Weaknesses CWE-441
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-27T02:16:20.307Z

Reserved: 2026-08-11T17:40:07.970Z

Link: CVE-2026-70398

cve-icon Vulnrichment

Updated: 2026-08-12T12:36:48.437Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T02:16:38.060

Modified: 2026-08-27T04:16:46.563

Link: CVE-2026-70398

cve-icon Redhat

Severity : Critical

Publid Date: 2026-08-11T00:00:00Z

Links: CVE-2026-70398 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T13:20:29Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')