CVE-2026-89060

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

View on CVE.org
Published Sep 11, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Description
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Analysis

AI-generated

Technical impact

A cross-namespace authorization flaw in multicluster-ob modify a ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add‑on may copy the referenced Secrets to the attacker‑controlled managed cluster, resulting in an unauthorized disclosure of confidential data (CWE‑551).

Affected Systems

The affected product is Red Hat Advanced Cluster Management for Kubernetes version 2. No specific sub‑versions are listed, so all releases in the 2.x line are potentially impacted.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity. The EPSS score of <1 % indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Explo a ManagedClusterAddOn configuration on a managed cluster and then reference hub resources, thereby exposing confidential Secrets to the attacker’s managed cluster and compromising confidentiality.

Remediation

Vendor Workaround

Disable MCOA log-forwarding and tracing capabilities that use ClusterLogForwarder or OpenTelemetryCollector resources.

OpenCVE Recommended Actions

  • Check Red Hat for available patches or advisories addressing this vulnerability.
  • Enforce RBAC rules that restrict managed‑cluster identities from accessing resources in other namespaces.
  • Validate configuration references to confirm they target only the intended namespace before deployment.
  • Disable MCOA log-forwarding and tracing capabilities that use ClusterLogForwarder or OpenTelemetryCollector resources.

Generated by OpenCVE AI on September 11, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.16::el9
cpe:/a:redhat:acm:2.17::el9
References
Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A cross-namespace authorization flaw in multicluster-observability-addon affects log-forwarding and tracing configurations that use ClusterLogForwarder or OpenTelemetryCollector resources. An authorized user who can modify ManagedClusterAddOn configuration could reference resources in another hub namespace, potentially disclosing associated Secrets to an attacker-controlled managed cluster. A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.
Type Values Removed Values Added
Description A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster. A cross-namespace authorization flaw in multicluster-observability-addon affects log-forwarding and tracing configurations that use ClusterLogForwarder or OpenTelemetryCollector resources. An authorized user who can modify ManagedClusterAddOn configuration could reference resources in another hub namespace, potentially disclosing associated Secrets to an attacker-controlled managed cluster.
Type Values Removed Values Added
Description A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.
Title Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
First Time appeared Redhat
Redhat acm
Weaknesses CWE-551
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}
Earlier changes (2)
Weaknesses
  • CWE-551

    Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Sep 21, 2026, 11:22 AM
Reserved
Sep 10, 2026, 6:21 PM

View source JSON

Updated
Sep 11, 2026, 4:31 PM

JSON

Status
Awaiting Analysis
Published
Sep 11, 2026, 5:16 AM
Modified
Sep 21, 2026, 12:17 PM

View source JSON

Severity
Important
Public date
Sep 10, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Sep 13, 2026, 7:15 PM

JSON