Log in / Sign up

Vulnerability details

CVE-2026-73122

Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

CVSS 3.1
7.7High

Official description

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure.

CVSS scores

ScoreVersionSourceVector
7.7High 3.1 CVEProject cvelistV5 (CNA) (redhat) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

VendorProductVersionsSource
No product information recorded.

References and advisories

8
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-08-12
Last updated
2026-09-05
State
Published
Assigner (CNA)
redhat

Exploit prediction (EPSS)

0.48%
Probability of exploitation in 30 days
41.9%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-269
    Improper Privilege Management