What’s Vulnerable › Vulnerabilities

CVE-2026-73122: Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-10-24
• Weakness: CWE-269

Description

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure.

Affected products

• Red Hat Advanced Cluster Management for Kubernetes 2.11: all versions — fixed in 1787260663
• Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1787259310
• Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1787172840
• Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1787238600
• Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1787242105
• Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787242099

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.11 1787260663; Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259310; Red Hat Advanced Cluster Management for Kubernetes 2.14 1787172840; Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238600; Red Hat Advanced Cluster Management for Kubernetes 2.16 1787242105; Red Hat Advanced Cluster Management for Kubernetes 2.17 1787242099. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:60386
• https://access.redhat.com/errata/RHSA-2026:60387
• https://access.redhat.com/errata/RHSA-2026:60388
• https://access.redhat.com/errata/RHSA-2026:60389
• https://access.redhat.com/errata/RHSA-2026:60390
• https://access.redhat.com/errata/RHSA-2026:60391
• https://access.redhat.com/security/cve/CVE-2026-73122
• https://bugzilla.redhat.com/show_bug.cgi?id=2514230

Get alerted when CVE-2026-73122 or the next vulnerability affects your stack