CVE-2026-64927: Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-12 · updated 2026-10-24
Weakness: CWE-639

Description

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2.11: all versions — fixed in 1787260663
Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1787259310
Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1787172840
Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1787238600
Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1787242105
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787242099

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.11 1787260663; Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259310; Red Hat Advanced Cluster Management for Kubernetes 2.14 1787172840; Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238600; Red Hat Advanced Cluster Management for Kubernetes 2.16 1787242105; Red Hat Advanced Cluster Management for Kubernetes 2.17 1787242099. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64927 or the next vulnerability affects your stack