Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
21 CVEs affecting Red Hat Red Hat Advanced Cluster Management For Kubernetes 2. Latest disclosed: 2026-11-06. Critical: 1, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66786 | Critical | 9.1 | 2026-09-02 | A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) with… |
CVE-2026-89091 | High | 8.8 | 2026-10-08 | A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lex… |
CVE-2026-70495 | High | 8.8 | 2026-08-17 | A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups acro… |
CVE-2026-66785 | High | 8.7 | 2026-08-20 | A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters)… |
CVE-2025-2241 | High | 8.2 | 2025-03-17 | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be e… |
CVE-2025-14874 | High | 7.5 | 2025-12-18 | A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the… |
CVE-2025-13033 | High | 7.5 | 2025-11-14 | A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit… |
CVE-2023-3089 | High | 7.0 | 2023-07-05 | A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic m… |
CVE-2026-123037 | Medium | 6.7 | 2026-11-06 | A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/… |
CVE-2026-92615 | Medium | 6.6 | 2026-09-16 | A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include Insecu… |
CVE-2024-5042 | Medium | 6.6 | 2024-05-17 | A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a… |
CVE-2026-66780 | Medium | 6.5 | 2026-08-18 | A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive perm… |
CVE-2025-7195 | Medium | 6.4 | 2025-08-07 | Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15… |
CVE-2026-66782 | Medium | 5.8 | 2026-08-18 | A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Sub… |
CVE-2026-93685 | Medium | 5.4 | 2026-09-18 | A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in th… |
CVE-2026-66781 | Medium | 5.4 | 2026-08-18 | A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (P… |
CVE-2025-11065 | Medium | 5.3 | 2026-01-26 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information… |
CVE-2024-0874 | Medium | 5.3 | 2024-04-25 | A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching. |
CVE-2026-66783 | Medium | 4.4 | 2026-08-18 | A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrato… |
CVE-2022-3248 | Medium | 4.4 | 2023-10-05 | A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries… |