VDB

CVE-2026-89060

CVE-2026-89060 PUBLISHED CVSS 7.7 HIGH

Reported by redhat · Published September 11, 2026

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Risk Scores

CVSS 3.1
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Products

VendorProductVersions
0
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.131789126264
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.141789126262
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.151789126262
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.161789126267
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171789126264
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171789126264
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.161789126267
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.131789126264
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.141789126262
0, 0
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.151789126262

Timeline

  • Sep 11, 2026 EPSS Score
  • Sep 11, 2026 Coalition ESS Score
  • Sep 11, 2026 CVE Published
  • Sep 12, 2026 EPSS Score
  • Sep 17, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score
  • Sep 21, 2026 CVE Updated
  • Sep 22, 2026 EPSS Score
  • Sep 22, 2026 Distribution Patch
  • Sep 22, 2026 Distribution Patch
  • Sep 22, 2026 Distribution Patch
  • Sep 22, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›