Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
60 CVEs affecting Red Hat Red Hat Advanced Cluster Management For Kubernetes 2. Latest disclosed: 2026-10-08. Critical: 14, High: 23.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67567 | Critical | 9.9 | 2026-08-20 | A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resou… |
CVE-2026-66788 | Critical | 9.9 | 2026-08-20 | A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource in… |
CVE-2026-70496 | Critical | 9.9 | 2026-08-19 | A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other enti… |
CVE-2026-66792 | Critical | 9.9 | 2026-08-17 | A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by crea… |
CVE-2026-72508 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin… |
CVE-2026-72526 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Applic… |
CVE-2026-70398 | Critical | 9.6 | 2026-08-12 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, refer… |
CVE-2025-10894 | Critical | 9.6 | 2025-09-24 | Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, vi… |
CVE-2026-16242 | Critical | 9.4 | 2026-07-20 | A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and… |
CVE-2026-66786 | Critical | 9.1 | 2026-09-02 | A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) with… |
CVE-2026-71470 | Critical | 9.1 | 2026-08-19 | A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fi… |
CVE-2026-71472 | Critical | 9.1 | 2026-08-17 | A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) edit… |
CVE-2026-71471 | Critical | 9.0 | 2026-08-12 | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Res… |
CVE-2026-10090 | Critical | 9.0 | 2026-08-05 | A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM)… |
CVE-2026-89091 | High | 8.8 | 2026-10-08 | A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lex… |
CVE-2026-66793 | High | 8.8 | 2026-08-18 | A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate… |
CVE-2026-70495 | High | 8.8 | 2026-08-17 | A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups acro… |
CVE-2026-66787 | High | 8.7 | 2026-08-20 | A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of ad… |
CVE-2026-66785 | High | 8.7 | 2026-08-20 | A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters)… |
CVE-2026-75924 | High | 8.7 | 2026-08-18 | A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across… |