by Kastro CVE-2026-67567
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 — Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction
Description · from the CVE record
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.
Affected
ProductAffectedFixed inSource
Red Hat Advanced Cluster Management for Kubernetes 2.11see advisory1787263584CNA
Red Hat Advanced Cluster Management for Kubernetes 2.13see advisory1787263693CNA
Red Hat Advanced Cluster Management for Kubernetes 2.14see advisory1787170830CNA
Red Hat Advanced Cluster Management for Kubernetes 2.15see advisory1787240030CNA
Red Hat Advanced Cluster Management for Kubernetes 2.16see advisory1787242321CNA
Red Hat Advanced Cluster Management for Kubernetes 2.17see advisory1787242108CNA
Scores by source
redhat (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total