CVE-2026-73137

Received Received - Intake

Red Hat Advanced Cluster Management Credential Exfiltration via HelmRelease

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: redhat-SADP

Description

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-73137

EUVD

EUVD-2026-63590

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	advanced_cluster_management	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is in Red Hat Advanced Cluster Management's multicloud-operators-subscription component. A tenant with HelmRelease create permissions can manipulate the secretRef.Namespace field to trick the HelmRelease controller into fetching sensitive credentials from any namespace. These credentials are then sent to an attacker-controlled Helm repository, leading to credential exfiltration from Secrets in arbitrary namespaces.

Impact Analysis

If exploited, this vulnerability allows unauthorized access to sensitive credentials stored in Secrets across any namespace. Attackers could steal these credentials and use them to access protected systems or data, leading to potential data breaches or further attacks within the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this flaw.

Mitigation Strategies

Restrict permissions for HelmRelease creation to prevent unauthorized access to Secrets across namespaces. Review and audit existing HelmRelease resources for suspicious activity involving secretRef.Namespace modifications.

Hi! I’m here to help you understand CVE-2026-73137. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70