Security Advisory catalog CVE-2026-89060
cve-program · CVE-2026-89060 Published
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-89060 Published multicluster-observability-addon https://github.com/stolostron/multicluster-observability-addon
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"repo": "https://github.com/stolostron/multicluster-observability-addon",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "ad36a3ba9fd946c04de71621e47486f7aa2634fd",
"status": "unaffected"
},
{
"at": "683191e26a0ecb1a36d3e58470f1c1bed1ba62d4",
"status": "unaffected"
},
{
"at": "8139c3ac7d388e0b3b008d1fb7d9bbdfabe252bb",
"status": "unaffected"
},
{
"at": "691eb796f04e358adeae441b453dbfdc576ff7fe",
"status": "unaffected"
},
{
"at": "1f727af81d89c50c76d4db1f6ece7db39653006d",
"status": "unaffected"
}
],
"version": "0",
"lessThan": "*",
"versionType": "git"
}
],
"packageName": "multicluster-observability-addon",
"collectionURL": "https://github.com/stolostron/multicluster-observability-addon",
"defaultStatus": "affected"
} rhacm2/acm-multicluster-observability-addon-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-multicluster-observability-addon-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1789126264",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
]
} rhacm2/acm-multicluster-observability-addon-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-multicluster-observability-addon-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1789126262",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
]
} rhacm2/acm-multicluster-observability-addon-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-multicluster-observability-addon-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1789126262",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
]
} rhacm2/acm-multicluster-observability-addon-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-multicluster-observability-addon-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1789126267",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
]
} rhacm2/acm-multicluster-observability-addon-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-multicluster-observability-addon-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1789126264",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:acm:2.17::el9"
]
} Original source record · Cite this exact observation · Complete original publisher JSON