CVE-2026-89060

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Multicluster Observability Addon

Publication date: 2026-09-11

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-21

Generated

2026-10-02

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89060

EUVD

EUVD-2026-75948

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	multicluster-observability-addon	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-551	If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

Attack-Flow Graph

Executive Summary

This vulnerability is in the multicluster-observability-addon component. It allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to sensitive hub Secrets being disclosed to an attacker controlling a managed cluster.

Detection Guidance

To detect this vulnerability, inspect configuration resources in the multicluster-observability-addon for improper namespace references. Check for Secrets or ConfigMaps referenced outside the ManagedClusterAddOn namespace or MCOA install namespace. Use commands like 'oc get clusterrolebindings -A' to review permissions and 'oc get secrets -A' to identify exposed Secrets.

Impact Analysis

An attacker controlling a managed cluster could access sensitive hub Secrets, potentially leading to information disclosure. The vulnerability requires low privileges and network access, making it exploitable with minimal conditions.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive hub Secrets to attacker-controlled managed clusters, which may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule on integrity and confidentiality of protected health information). Unauthorized access to secrets may result in non-compliance with these regulations.

Mitigation Strategies

Since no fixes have been released yet, avoid granting managed clusters excessive permissions. Review namespace configurations to ensure managed-cluster identities cannot reference resources outside their designated namespaces. Monitor for unauthorized access attempts to hub Secrets.

Hi! I’m here to help you understand CVE-2026-89060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70