Red Hat Security Advisory

RHSA-2026:60389

Red Hat Advanced Cluster Management for Kubernetes v2.15.6 security update

Released 2026-08-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19

Fixes 40 records

TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

HIGH 77

form-data is a library for creating readable multipart/form-data streams.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00669 Published 2026-06-12 Partial fix · 2.5.6, 3.0.5 +1 CWE-93

TI-2026-40198 CVE-2026-55677 · GHSA-vfp3-v2gw-7wfq

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

HIGH 72

Echo is a Go web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00519 Published 2026-06-26 Partial fix · 4.15.3, 5.2.0 CWE-22

TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835

OpenTelemetry-Go's baggage parsing no longer caps raw header length

MEDIUM 63

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2026-06-04 Partial fix · 1.42.0, 1.44.0 CWE-789

TI-2026-47440 CVE-2026-66800 · GHSA-hjp2-pvfv-h8vh

Azure Data Factory Information Disclosure Vulnerability

MEDIUM 45

Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00973 Published 2026-08-20 Fixed CWE-918

TI-2026-50788 CVE-2026-72526 · GHSA-hp26-rmxw-4cpv

Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub…

MEDIUM 44

A flaw was found in the multicloud-integrations component.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00705 Published 2026-08-12 Fixed in 1787260689, 1787259106 +4 CWE-441

TI-2026-50784 CVE-2026-72508 · GHSA-hr6f-38vx-3c48

Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke…

MEDIUM 44

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0081 Published 2026-08-12 Fixed in 1787263584, 1787263693 +4 CWE-250

TI-2026-49269 CVE-2026-70496 · GHSA-xg68-vc28-3f79

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent…

MEDIUM 44

A flaw was found in search-v2-operator.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00552 Published 2026-08-19 Fixed in 1787688827, 1787682112 +5 CWE-250

TI-2026-47742 CVE-2026-67567 · GHSA-gf3r-gm67-jgrv

Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart…

MEDIUM 44

A flaw was found in the multicloud-operators-subscription component.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0062 Published 2026-08-20 Fixed in 1787263584, 1787263693 +4 CWE-441

TI-2026-47433 CVE-2026-66792 · GHSA-8jj2-p7p7-6mr3

Incorrect authorization in Red Hat Multicluster Global Hub 1.4.9

MEDIUM 44

A flaw was found in the multicloud-operators-subscription component.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00689 Published 2026-08-17 Partial fix · 1788355439, 1788355599 +19 CWE-863

TI-2026-50087 CVE-2026-71472 · GHSA-gqg9-92w2-w94m

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

MEDIUM 43

A flaw was found in acm-search-v2-rhel9.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00912 Published 2026-08-17 Fixed in 1787688827, 1787682112 +4 CWE-78

TI-2026-49184 CVE-2026-70398 · GHSA-cjw2-r57r-pwvf

Multicloud-integrations: multicloud-integrations…

MEDIUM 43

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM).

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00521 Published 2026-08-12 Fixed in 1787260689, 1787259106 +4 CWE-441

TI-2026-50085 CVE-2026-71470 · GHSA-5g3m-2273-p6x6

Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow…

MEDIUM 42

A flaw was found in the search-v2-operator.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00707 Published 2026-08-19 Fixed in 1787688827, 1787682112 +4 CWE-913

TI-2026-47434 CVE-2026-66793 · GHSA-xh6j-xcjj-j38g

Improper input validation in Red Hat Advanced Cluster Management for Kubernetes 2.11

MEDIUM 42

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0081 Published 2026-08-18 Fixed in 1787683327, 1787259078 +4 CWE-20

TI-2026-08844 CVE-2026-10090 · GHSA-g9vp-wj77-5767

Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit…

MEDIUM 42

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM).

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.00577 Published 2026-08-05 Fixed in 1787263584, 1787263693 +4 CWE-267

TI-2026-50086 CVE-2026-71471 · GHSA-j9xr-mxxr-3948

Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated…

MEDIUM 41

A flaw was found in acm-search-v2-rhel9.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.01217 Published 2026-08-12 Fixed in 1787688827, 1787682112 +4 CWE-829

TI-2026-50084 CVE-2026-71469 · GHSA-6gx2-rqm4-38f9

Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos

MEDIUM 40

A flaw was found in search-v2-api.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00737 Published 2026-08-12 Fixed in 1787689524, 1787263804 +4 CWE-770

TI-2026-34259 CVE-2026-46600 · GHSA-gg3m-vvp2-p2c5

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

MEDIUM 40

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00549 Published 2026-07-21 Partial fix · 1.26.6, 1.27.0-rc.3 +1 CWE-125

TI-2026-49268 CVE-2026-70495 · GHSA-q7g5-25j5-rf23

Improper privilege management in Red Hat Advanced Cluster Management for Kubernetes 2.11

LOW 39

A flaw was found in search-v2-operator.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00157 Published 2026-08-17 Partial fix · 1787688827, 1787682112 +4 CWE-269

TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r

Infinite loop on invalid input in golang.org/x/text

LOW 39

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2026-07-21 Partial fix · 0.39.0 CWE-835

TI-2026-34805 CVE-2026-47219 · GHSA-c96f-x56v-gq3h

find-my-way is Vulnerable to DDoS with HTTP2

LOW 39

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-07-28 Partial fix · 9.7.0 CWE-20

TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj

Prometheus Azure AD remote write OAuth client secret exposed via config API

LOW 39

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00352 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +1 CWE-200

TI-2026-50088 CVE-2026-71473 · GHSA-mm7v-f498-mqrj

Mass assignment in Red Hat Advanced Cluster Management for Kubernetes 2.11

LOW 37

A flaw was found in the `search-v2-operator` component.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00473 Published 2026-08-12 Fixed in 1787688827, 1787682112 +4 CWE-915

TI-2026-47443 CVE-2026-66804 · GHSA-m9fr-m5pc-g6ww

Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability

LOW 36

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00298 Published 2026-08-11 Fixed in 10.0.19045.7663, 10.0.26100.9168 +2 CWE-284

TI-2026-47439 CVE-2026-66799 · GHSA-cr27-wq5j-8m89

Windows Key Guard Elevation of Privilege Vulnerability

LOW 36

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00333 Published 2026-08-11 Fixed in 10.0.14393.9418, 10.0.17763.9121 +10 CWE-122

TI-2026-51303 CVE-2026-73137 · GHSA-rf6j-x765-j4p2

Information disclosure in Red Hat Advanced Cluster Management for Kubernetes 2.11

LOW 34

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00527 Published 2026-08-20 Fixed in 1787263584, 1787263693 +4 CWE-200

TI-2026-51300 CVE-2026-73122 · GHSA-5rf6-jwvg-8r55

Improper privilege management in Red Hat Advanced Cluster Management for Kubernetes 2.11

LOW 34

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00483 Published 2026-08-12 Fixed in 1787260663, 1787259310 +4 CWE-269

TI-2026-50174 CVE-2026-71845 · GHSA-h2jx-ffv3-pwqm

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

LOW 34

A flaw was found in insights-client.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00501 Published 2026-08-11 Fixed in 1787688993, 1787259125 +4 CWE-532

TI-2026-47466 CVE-2026-66878 · GHSA-37c6-v768-8x6w

Authorization bypass in Red Hat Advanced Cluster Management for Kubernetes 2.11

LOW 34

A flaw was found in multicloud-operators-subscription.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00483 Published 2026-08-12 Fixed in 1787263584, 1787263693 +4 CWE-639

TI-2026-53667 CVE-2026-76827 · GHSA-4vrw-8fx2-pj82

Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

LOW 31

A flaw was found in search-indexer.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00525 Published 2026-08-19 Fixed in 1787688957, 1787262474 +4 CWE-693

TI-2026-50090 CVE-2026-71475 · GHSA-gqvx-3g3q-49g9

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

LOW 31

A flaw was found in insights-client.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00694 Published 2026-08-11 Fixed in 1787259125, 1786882244 +3 CWE-22

TI-2026-50089 CVE-2026-71474 · GHSA-6q5x-r3rm-rpv8

Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response

LOW 30

A flaw was found in insights-client.

CVSS 3.1HIGH 7.1 Local No auth No interaction EPSS 0.00156 Published 2026-08-11 Fixed in 1787688993, 1787259125 +4 CWE-532

TI-2026-50175 CVE-2026-71846 · GHSA-wfwr-qqxc-6cch

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

LOW 28

A flaw was found in insights-client.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.0016 Published 2026-08-12 Fixed in 1787688993, 1787259125 +4 CWE-250

TI-2026-46417 CVE-2026-64927 · GHSA-crwr-8cwh-w292

Authorization bypass in Red Hat Advanced Cluster Management for Kubernetes 2.11

LOW 28

A flaw was found in the multicloud-operators-channel component.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00328 Published 2026-08-12 Fixed in 1787260663, 1787259310 +4 CWE-639

TI-2026-15443 CVE-2026-18874 · GHSA-9w6h-ch94-8j27

Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11

LOW 28

A flaw was found in volsync-addon-controller.

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.00538 Published 2026-08-19 Fixed in 1787683560, 1787266564 +2 CWE-94

TI-2026-47437 CVE-2026-66797 · GHSA-6777-p72p-347g

Apache CloudStack: Unauthorised comment creation and disclosure

LOW 25

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00461 Published 2026-08-21 Fixed CWE-284

TI-2026-47426 CVE-2026-66781 · GHSA-gcch-g8g2-6852

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

LOW 25

A flaw was found in the Submariner operator.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00395 Published 2026-08-18 Partial fix · 1787689013, 1787365971 +8 CWE-749

TI-2026-52869 CVE-2026-75485 · GHSA-28f5-gvgw-386q

Must-gather: /tmp/kubeconfig retention

LOW 24

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00195 Published 2026-08-18 Fixed in 1787263322, 1787260453 +4 CWE-532

TI-2026-51861 CVE-2026-73834 · GHSA-8m45-79jm-xw59

Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

LOW 24

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00111 Published 2026-08-18 Fixed in 1787263322, 1787260453 +4 CWE-312

TI-2026-50083 CVE-2026-71468 · GHSA-wg82-w434-qwgq

Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

LOW 24

A flaw was found in acm-search-v2-api-rhel9.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00423 Published 2026-08-11 Fixed in 1787689524, 1787263804 +4 CWE-266

TI-2026-47438 CVE-2026-66798 · GHSA-c27v-65fh-7pg2

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

LOW 23

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00786 Published 2026-08-28 Fixed in 152.0.4191.53, 152.0.4191.52 CWE-416