CVE-2026-66793: Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-08-27
Weakness: CWE-20

Description

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2.11: all versions — fixed in 1787683327
Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1787259078
Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1787080755
Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1787238535
Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1787080753
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787227696

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.11 1787683327; Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259078; Red Hat Advanced Cluster Management for Kubernetes 2.14 1787080755; Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238535; Red Hat Advanced Cluster Management for Kubernetes 2.16 1787080753; Red Hat Advanced Cluster Management for Kubernetes 2.17 1787227696. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66793 or the next vulnerability affects your stack