CVE-2026-89060: Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-11 · updated 2026-09-21
Weakness: CWE-551

Description

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1789126264
Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1789126262
Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1789126262
Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1789126267
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1789126264

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.13 1789126264; Red Hat Advanced Cluster Management for Kubernetes 2.14 1789126262; Red Hat Advanced Cluster Management for Kubernetes 2.15 1789126262; Red Hat Advanced Cluster Management for Kubernetes 2.16 1789126267; Red Hat Advanced Cluster Management for Kubernetes 2.17 1789126264. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89060 or the next vulnerability affects your stack