Description
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.
Published: 2026-09-11
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Secret Disclosure
Action: Monitor
AI Analysis

Impact

A cross-namespace authorization flaw in multicluster-ob modify a ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add‑on may copy the referenced Secrets to the attacker‑controlled managed cluster, resulting in an unauthorized disclosure of confidential data (CWE‑551).

Affected Systems

The affected product is Red Hat Advanced Cluster Management for Kubernetes version 2. No specific sub‑versions are listed, so all releases in the 2.x line are potentially impacted.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity. The EPSS score of <1 % indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Explo a ManagedClusterAddOn configuration on a managed cluster and then reference hub resources, thereby exposing confidential Secrets to the attacker’s managed cluster and compromising confidentiality.

Generated by OpenCVE AI on September 11, 2026 at 16:25 UTC.

Remediation

Vendor Workaround

Disable MCOA log-forwarding and tracing capabilities that use ClusterLogForwarder or OpenTelemetryCollector resources.

OpenCVE Recommended Actions

  • Check Red Hat for available patches or advisories addressing this vulnerability.
  • Enforce RBAC rules that restrict managed‑cluster identities from accessing resources in other namespaces.
  • Validate configuration references to confirm they target only the intended namespace before deployment.
  • Disable MCOA log-forwarding and tracing capabilities that use ClusterLogForwarder or OpenTelemetryCollector resources.

Generated by OpenCVE AI on September 11, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.16::el9
cpe:/a:redhat:acm:2.17::el9
References

Sun, 13 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description A cross-namespace authorization flaw in multicluster-observability-addon affects log-forwarding and tracing configurations that use ClusterLogForwarder or OpenTelemetryCollector resources. An authorized user who can modify ManagedClusterAddOn configuration could reference resources in another hub namespace, potentially disclosing associated Secrets to an attacker-controlled managed cluster. A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Fri, 11 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster. A cross-namespace authorization flaw in multicluster-observability-addon affects log-forwarding and tracing configurations that use ClusterLogForwarder or OpenTelemetryCollector resources. An authorized user who can modify ManagedClusterAddOn configuration could reference resources in another hub namespace, potentially disclosing associated Secrets to an attacker-controlled managed cluster.

Fri, 11 Sep 2026 04:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.
Title Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
First Time appeared Redhat
Redhat acm
Weaknesses CWE-551
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-21T11:22:19.529Z

Reserved: 2026-09-10T18:21:30.542Z

Link: CVE-2026-89060

cve-icon Vulnrichment

Updated: 2026-09-11T16:31:52.748Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-11T05:16:38.557

Modified: 2026-09-21T12:17:23.503

Link: CVE-2026-89060

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-10T00:00:00Z

Links: CVE-2026-89060 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T19:15:14Z

Weaknesses
  • CWE-551

    Incorrect Behavior Order: Authorization Before Parsing and Canonicalization