CVE-2026-89060 in Advanced Cluster Management for Kubernetes
Summary
by MITRE • 09/11/2026
A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The identified vulnerability resides within the multicluster observability addon, a component critical for aggregating and managing telemetry data across distributed Kubernetes environments. The core technical flaw stems from insufficient access control mechanisms governing how managed-cluster identities interact with configuration resources on the central hub cluster. Specifically, the addon fails to strictly enforce namespace boundaries when processing requests initiated by these identities. This architectural oversight allows an identity associated with a specific managed cluster to construct API calls that reference or retrieve configuration objects located in namespaces other than its own designated scope. In standard Kubernetes security models, RBAC policies are typically scoped to prevent cross-namespace access unless explicitly permitted; however, the logic within this addon bypasses these checks for certain resource types, creating an unauthorized pathway for data exfiltration.
The operational impact of this flaw is severe, primarily centering on the potential disclosure of sensitive hub Secrets. In a multi-cluster architecture, the hub cluster often stores critical credentials, API keys, and certificates required to manage the fleet of managed clusters. Because the vulnerability permits access beyond the intended namespace boundary, an attacker who has compromised or controls a managed cluster identity can leverage this flaw to query these restricted resources. This effectively elevates privileges from a low-impact local compromise on a worker node to a high-impact breach of central infrastructure secrets. The exposure of hub Secrets can lead to further lateral movement within the cluster environment, allowing an attacker to impersonate service accounts, access other namespaces, or potentially take control over additional managed clusters that rely on shared credentials stored in those exposed secrets.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the accessed secrets contain static values. It also maps to MITRE ATT&CK techniques such as T1506 Post-exploitation for credential harvesting and T1078 Valid Accounts, where an attacker uses legitimate but misconfigured identities to gain unauthorized access. The flaw represents a classic case of broken object level authorization (BOLA) within the context of Kubernetes RBAC enforcement, highlighting the risks associated with overly permissive addon configurations or bugs in their internal logic that fail to validate resource namespaces against identity permissions.
Mitigation strategies must focus on immediate remediation and long-term architectural hardening. Administrators should immediately update the multicluster observability addon to a patched version where this namespace validation issue has been resolved by the vendor. In parallel, it is crucial to audit RBAC policies for all managed cluster identities to ensure they adhere to the principle of least privilege, explicitly denying access to resources outside their designated namespaces unless absolutely necessary for operational functionality. Additionally, organizations should implement network policies and admission controllers that enforce strict namespace isolation at the API server level, providing a secondary layer of defense against such bypasses. Regular security assessments focusing on cross-namespace access patterns in multi-cluster setups are recommended to identify similar misconfigurations before they can be exploited by malicious actors seeking to escalate privileges or exfiltrate sensitive data from central management planes.