Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
27 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-92982 | | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection | HIGH 8.5 | 0.5 % | ||
| CVE-2026-89091 | | Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution | HIGH 8.8 | 0.5 % | ||
| CVE-2026-93685 | | Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcon… | MEDIUM 5.4 | 0.4 % | ||
| CVE-2026-92615 | | Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-66786 | | Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets | CRITICAL 9.1 | 1.4 % | ||
| CVE-2026-66785 | | Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack | HIGH 8.7 | 0.2 % | ||
| CVE-2026-70496 | | Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and ma… | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-66780 | | Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-66783 | | Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref | MEDIUM 4.4 | 0.4 % | ||
| CVE-2026-66782 | | Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps | MEDIUM 5.8 | 0.4 % | ||
| CVE-2026-66781 | | Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication | MEDIUM 5.4 | 0.4 % | ||
| CVE-2026-75924 | | Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval | HIGH 8.7 | 0.3 % | ||
| CVE-2026-70495 | | Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters | HIGH 8.8 | 0.2 % | ||
| CVE-2026-66792 | | Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters | CRITICAL 9.9 | 0.7 % | ||
| CVE-2026-16242 | | Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates | CRITICAL 9.4 | 0.9 % | ||
| CVE-2026-11332 | | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2025-11065 | | Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-14874 | | Nodemailer: nodemailer: denial of service via crafted email address header | HIGH 7.5 | 0.6 % | ||
| CVE-2025-13033 | | Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict | HIGH 7.5 | 0.6 % | ||
| CVE-2025-10894 | | Nx: nx/devkit: malicious versions of nx and plugins published to npm | CRITICAL 9.6 | 0.6 % | ||
| CVE-2025-2241 | | Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm | HIGH 8.2 | 0.5 % | ||
| CVE-2024-11831 | | Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript | MEDIUM 5.4 | 1.1 % | ||
| CVE-2024-9779 | | Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens | HIGH 7.5 | 0.4 % | ||
| CVE-2024-5042 | | Submariner-operator: rbac permissions can allow for the spread of node compromises | MEDIUM 6.6 | 0.5 % | ||
| CVE-2024-0874 | | Coredns: cd bit response is cached and served later | MEDIUM 5.3 | 0.8 % | ||
| CVE-2022-3248 | | Openshift api admission checks does not enforce "custom-host" permissions | HIGH 7.5 | 0.5 % | ||
| CVE-2023-3089 | | Ocp & fips mode | HIGH 7.5 | 0.5 % |