CVE-2026-93685

Red Hat Advanced Cluster Management for Kubernetes 2 · Vulnerability

CVSS 3.1 5.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93685

Published

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93685

Published

redhat-user-workloads/multicluster-observability-addon-acm-213

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-user-workloads/multicluster-observability-addon-acm-213",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:acm:2"
                    ]
                }

rhacm2/acm-multicluster-observability-addon-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhacm2/acm-multicluster-observability-addon-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:acm:2"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON