CVE-2026-73122 in Advanced Cluster Management for Kubernetes
Summary
by MITRE • 08/12/2026
A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists within the multicloud-operators-channel component of Red Hat Advanced Cluster Management, representing a critical authorization flaw that undermines the security boundaries between managed clusters and the central hub management system. The issue stems from insufficient access controls that allow compromised agents to escalate their privileges beyond intended boundaries, creating a pathway for lateral movement and data exfiltration. The flaw specifically affects the Channel namespace functionality where Secrets and ConfigMaps containing sensitive repository credentials are stored, enabling unauthorized information disclosure across tenant environments.
The technical implementation of this vulnerability demonstrates a failure in proper access control enforcement within the RHACM architecture, where the compromised agent can bypass normal authorization mechanisms to read all Secrets and ConfigMaps within any Channel namespace on the hub. This represents a direct violation of the principle of least privilege and creates an attack vector that aligns with CWE-285, which addresses improper authorization in software systems. The vulnerability operates at the application level where the channel operator fails to properly validate access requests from managed agents against the security policies governing resource access within the hub cluster.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass potential compromise of entire tenant environments and cross-tenant data exposure. When a single agent is compromised, attackers can access repository credentials for multiple tenants, potentially enabling them to clone repositories, modify configurations, or even inject malicious code into deployment pipelines. This creates cascading security risks where the compromise of one managed cluster can lead to unauthorized access across all other clusters managed through the same hub. The vulnerability particularly affects multi-tenant deployments where isolation between different customer environments is critical for maintaining security boundaries.
Organizations utilizing Red Hat Advanced Cluster Management should implement immediate mitigations including enhanced network segmentation between managed clusters and the hub, implementing stricter RBAC policies with more granular access controls, and conducting thorough security audits of all Channel namespace configurations. The ATT&CK framework categorizes this vulnerability under T1566 for credential access and T1046 for network service scanning, as attackers would likely attempt to enumerate available resources before exploiting this weakness. Additionally, organizations should consider implementing additional monitoring and alerting mechanisms to detect unauthorized access attempts to sensitive namespaces, while also ensuring that all agents are running the latest security patches from Red Hat to prevent exploitation of known vulnerabilities in the multicloud-operators-channel component.