CVE-2026-73122

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Red Hat Advanced Cluster Management

Publication date: 2026-08-12

Last updated on: 2026-08-27

Assigner: redhat-SADP

Description

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-27

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73122

EUVD

EUVD-2026-57060

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	advanced_cluster_management	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in Red Hat Advanced Cluster Management (RHACM) multicloud-operators-channel component. A flaw in an auto-generated Role grants excessive permissions to managed-cluster agents. A compromised agent can read all Secrets and ConfigMaps in any Channel namespace on the hub, exposing sensitive credentials for Git and Helm repositories across tenants.

Detection Guidance

Detection involves checking for unauthorized access to Secrets and ConfigMaps in Channel namespaces. Inspect Kubernetes audit logs for unusual read operations by managed-cluster agents. Use commands like 'kubectl get secrets -A' and 'kubectl get configmaps -A' to review permissions. Check RoleBindings for excessive permissions in Channel namespaces.

Impact Analysis

If you use RHACM, a compromised agent in a managed cluster could access sensitive information like credentials for other tenants' Git and Helm repositories. This may lead to unauthorized access, data breaches, or further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of credentials or secrets may result in non-compliance, potential fines, and reputational damage due to data breaches.

Mitigation Strategies

Monitor Red Hat's advisories for updates or apply available mitigations if applicable. Since mitigation options are under investigation, users should wait for official fixes from Red Hat.

Hi! I’m here to help you understand CVE-2026-73122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70