CVE-2026-18874
Received Received - Intake

YAML Injection in Volsync Addon Controller

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: redhat-SADP

Description
A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-18874
EUVD
EUVD-2026-62669

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat volsync_addon_controller *
redhat volsync-addon-controller *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a YAML injection flaw in the volsync-addon-controller. It occurs when annotation values are improperly escaped when rendered into YAML for the OpenShift Lifecycle Manager (OLM) Subscription resource. Attackers can inject malicious YAML code, potentially modifying OLM Subscription configurations and impacting software management in the cluster.

Detection Guidance

Check if the 'volsync-addon-deploy-type: olm' annotation is set in your OLM Subscription resources. Inspect YAML configurations for improperly escaped annotation values that could indicate injection attempts.

Impact Analysis

Exploitation could lead to unauthorized changes in OLM Subscription configurations, affecting how software is managed within your cluster. This may disrupt operations or allow attackers to gain control over software deployments, especially if the vulnerable annotation is enabled.

Compliance Impact

This vulnerability primarily impacts software management within OpenShift clusters by allowing unauthorized modifications to OLM Subscription configurations through YAML injection. While it does not directly affect data protection standards like GDPR or HIPAA, unauthorized changes to cluster configurations could indirectly lead to non-compliance if they result in improper data handling, access controls, or audit failures. The risk is limited to systems with the 'volsync-addon-deploy-type: olm' annotation explicitly enabled, which is not the default setting.

Mitigation Strategies

Ensure the 'volsync-addon-deploy-type' annotation is not set to 'olm'. If it is, remove or modify it to use the default Helm deployment type. Review and sanitize annotation values in OLM Subscription resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18874. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart