Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14

31 published vulnerabilities name this product.

As the CNAs write it in their CVE records (vendor and product); the versions are theirs.

CVEVulnerable versionsTitleSeverityPublishedEPSSExploitation
CVE-2026-89060fixed in 1789126262Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated config…HIGH 7.70.5 %
CVE-2026-73137fixed in 1787170830Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.…HIGH 7.70.5 %
CVE-2026-67567fixed in 1787170830Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespa…CRITICAL 9.90.6 %
CVE-2026-76827fixed in 1787250074Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)MEDIUM 6.80.5 %
CVE-2026-76139fixed in 1787704476Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentialsHIGH 8.00.7 %
CVE-2026-70496fixed in 1787682033Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and ma…CRITICAL 9.90.6 %
CVE-2026-18874fixed in 1787266564Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml i…MEDIUM 6.20.5 %
CVE-2026-71470fixed in 1787682033Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating saCRITICAL 9.10.7 %
CVE-2026-66780fixed in 1789136328Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosityMEDIUM 6.50.6 %
CVE-2026-66781fixed in 1787362756Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationMEDIUM 5.40.4 %
CVE-2026-75485fixed in 1787189811Must-gather: /tmp/kubeconfig retentionMEDIUM 5.50.2 %
CVE-2026-73834fixed in 1787189811Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redactionMEDIUM 5.50.1 %
CVE-2026-66793fixed in 1787080755Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annota…HIGH 8.80.8 %
CVE-2026-71472fixed in 1787682033Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_memCRITICAL 9.10.9 %
CVE-2026-70495fixed in 1787682033Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:mastersHIGH 8.80.2 %
CVE-2026-66792Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersCRITICAL 9.90.7 %
CVE-2026-71846fixed in 1786882244Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilegeMEDIUM 6.50.2 %
CVE-2026-71469fixed in 1786723845Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dosHIGH 7.50.7 %
CVE-2026-71471fixed in 1787682033Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container imageCRITICAL 9.01.2 %
CVE-2026-71473fixed in 1787682033Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spokeHIGH 8.50.5 %
CVE-2026-72508fixed in 1787170830Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)CRITICAL 9.90.8 %
CVE-2026-64927fixed in 1787172840Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace co…MEDIUM 6.40.3 %
CVE-2026-73122fixed in 1787172840Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch…HIGH 7.70.5 %
CVE-2026-66878fixed in 1787170830Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace ena…HIGH 7.70.5 %
CVE-2026-70398fixed in 1787183407Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chos…CRITICAL 9.60.5 %
CVE-2026-72526fixed in 1787183407Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalida…CRITICAL 9.90.7 %
CVE-2026-71474fixed in 1786882244Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx responseHIGH 7.10.2 %
CVE-2026-71468fixed in 1786723845Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cacheMEDIUM 5.30.4 %
CVE-2026-71475fixed in 1786882244Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url pathMEDIUM 6.80.7 %
CVE-2026-71845fixed in 1786882244Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()HIGH 7.70.5 %
CVE-2026-10090fixed in 1787170830Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebindin…CRITICAL 9.00.6 %