Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13

31 vulnérabilités publiées citent ce produit.

Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.

CVEVersions vulnérablesTitreSévéritéPubliéeEPSSExploitation
CVE-2026-89060corrigé en 1789126264Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated config…HIGH 7.70.5 %
CVE-2026-73137corrigé en 1787263693Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.…HIGH 7.70.5 %
CVE-2026-67567corrigé en 1787263693Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespa…CRITICAL 9.90.6 %
CVE-2026-76827corrigé en 1787262474Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)MEDIUM 6.80.5 %
CVE-2026-76139corrigé en 1787712120Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentialsHIGH 8.00.7 %
CVE-2026-70496corrigé en 1787682112Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and ma…CRITICAL 9.90.6 %
CVE-2026-18874corrigé en 1787266564Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml i…MEDIUM 6.20.5 %
CVE-2026-71470corrigé en 1787682112Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating saCRITICAL 9.10.7 %
CVE-2026-66780corrigé en 1789131397Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosityMEDIUM 6.50.6 %
CVE-2026-66781corrigé en 1787365971Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationMEDIUM 5.40.4 %
CVE-2026-75485corrigé en 1787260453Must-gather: /tmp/kubeconfig retentionMEDIUM 5.50.2 %
CVE-2026-73834corrigé en 1787260453Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redactionMEDIUM 5.50.1 %
CVE-2026-66793corrigé en 1787259078Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annota…HIGH 8.80.8 %
CVE-2026-71472corrigé en 1787682112Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_memCRITICAL 9.10.9 %
CVE-2026-70495corrigé en 1787682112Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:mastersHIGH 8.80.2 %
CVE-2026-66792Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersCRITICAL 9.90.7 %
CVE-2026-71846corrigé en 1787259125Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilegeMEDIUM 6.50.2 %
CVE-2026-71469corrigé en 1787263804Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dosHIGH 7.50.7 %
CVE-2026-71471corrigé en 1787682112Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container imageCRITICAL 9.01.2 %
CVE-2026-71473corrigé en 1787682112Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spokeHIGH 8.50.5 %
CVE-2026-72508corrigé en 1787263693Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)CRITICAL 9.90.8 %
CVE-2026-64927corrigé en 1787259310Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace co…MEDIUM 6.40.3 %
CVE-2026-73122corrigé en 1787259310Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch…HIGH 7.70.5 %
CVE-2026-66878corrigé en 1787263693Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace ena…HIGH 7.70.5 %
CVE-2026-70398corrigé en 1787259106Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chos…CRITICAL 9.60.5 %
CVE-2026-72526corrigé en 1787259106Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalida…CRITICAL 9.90.7 %
CVE-2026-71474corrigé en 1787259125Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx responseHIGH 7.10.2 %
CVE-2026-71468corrigé en 1787263804Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cacheMEDIUM 5.30.4 %
CVE-2026-71475corrigé en 1787259125Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url pathMEDIUM 6.80.7 %
CVE-2026-71845corrigé en 1787259125Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()HIGH 7.70.5 %
CVE-2026-10090corrigé en 1787263693Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebindin…CRITICAL 9.00.6 %