CVE-2026-66878
Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration
- State
- Published
- Severity
- 7.7 High
- Published
- Aug 12, 2026
- Updated
- Sep 5, 2026
- Reserved
- Aug 11, 2026
Description
A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Red Hat Advanced Cluster Management for Kubernetes 2.11Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.13Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.14Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.15Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat |
|
References
- RHSA-2026:60386vendor-advisory
- RHSA-2026:60387vendor-advisory
- RHSA-2026:60388vendor-advisory
- RHSA-2026:60389vendor-advisory
- RHSA-2026:60390vendor-advisory
- RHSA-2026:60391vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-66878vdb-entry
- RHBZ#2514226issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.