What’s Vulnerable › Products

Red Hat Advanced Cluster Management for Kubernetes 2.15 vulnerabilities

27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.

Check whether your Red Hat Advanced Cluster Management for Kubernetes 2.15 version is affected

Latest Red Hat Advanced Cluster Management for Kubernetes 2.15 vulnerabilities

• CVE-2026-89060 — Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references (CVSS 7.7)
• CVE-2026-73137 — Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace (CVSS 7.7)
• CVE-2026-67567 — Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction (CVSS 9.9)
• CVE-2026-76827 — Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering) (CVSS 6.8)
• CVE-2026-76139 — Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials (CVSS 8.0)
• CVE-2026-70496 — Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork (CVSS 9.9)
• CVE-2026-18874 — Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription (CVSS 6.2)
• CVE-2026-71470 — Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa (CVSS 9.1)
• CVE-2026-66780 — Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity (CVSS 6.5)
• CVE-2026-66781 — Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication (CVSS 5.4)
• CVE-2026-75485 — Must-gather: /tmp/kubeconfig retention (CVSS 5.5)
• CVE-2026-73834 — Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction (CVSS 5.5)
• CVE-2026-66793 — Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke (CVSS 8.8)
• CVE-2026-71472 — Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem (CVSS 9.1)
• CVE-2026-70495 — Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters (CVSS 8.8)
• CVE-2026-66792 — Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters (CVSS 9.9)
• CVE-2026-71473 — Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke (CVSS 8.5)
• CVE-2026-71471 — Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image (CVSS 9.0)
• CVE-2026-71469 — Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos (CVSS 7.5)
• CVE-2026-72508 — Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*) (CVSS 9.9)
• CVE-2026-73122 — Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces (CVSS 7.7)
• CVE-2026-72526 — Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation (CVSS 9.9)
• CVE-2026-70398 — Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace (CVSS 9.6)
• CVE-2026-66878 — Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration (CVSS 7.7)
• CVE-2026-64927 — Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy (CVSS 6.4)