{"id":"CVE-2026-89060","state":"PUBLISHED","title":"Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references","description":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.","publishedAt":"2026-09-11T04:22:47.524Z","updatedAt":"2026-09-21T11:22:19.529Z","severity":{"score":7.7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"redhat"},"assigner":"redhat","products":["multicluster-observability-addon","Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13","Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14","Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15","Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16","Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17"],"affected":[{"packageName":"multicluster-observability-addon","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"*","changes":[{"at":"ad36a3ba9fd946c04de71621e47486f7aa2634fd","status":"unaffected"},{"at":"683191e26a0ecb1a36d3e58470f1c1bed1ba62d4","status":"unaffected"},{"at":"8139c3ac7d388e0b3b008d1fb7d9bbdfabe252bb","status":"unaffected"},{"at":"691eb796f04e358adeae441b453dbfdc576ff7fe","status":"unaffected"},{"at":"1f727af81d89c50c76d4db1f6ece7db39653006d","status":"unaffected"}],"versionType":"git"}],"repo":"https://github.com/stolostron/multicluster-observability-addon","collectionURL":"https://github.com/stolostron/multicluster-observability-addon"},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.13","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126264","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.13::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.14","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126262","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.14::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.15","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126262","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.15::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.16","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126267","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.17","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126264","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.17::el9"]}],"references":["https://access.redhat.com/errata/RHSA-2026:67539","https://access.redhat.com/errata/RHSA-2026:67540","https://access.redhat.com/errata/RHSA-2026:67541","https://access.redhat.com/errata/RHSA-2026:67542","https://access.redhat.com/errata/RHSA-2026:67543","https://access.redhat.com/security/cve/CVE-2026-89060","https://bugzilla.redhat.com/show_bug.cgi?id=2531596","https://github.com/stolostron/multicluster-observability-addon/pull/644"],"weaknesses":["CWE-551"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89060.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89060","state":"PUBLISHED","datePublished":"2026-09-11T04:22:47.524Z","dateUpdated":"2026-09-21T11:22:19.529Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-09-10T18:21:30.542Z"},"containers":{"cna":{"title":"Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references","descriptions":[{"lang":"en","value":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster."}],"affected":[{"packageName":"multicluster-observability-addon","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"*","changes":[{"at":"ad36a3ba9fd946c04de71621e47486f7aa2634fd","status":"unaffected"},{"at":"683191e26a0ecb1a36d3e58470f1c1bed1ba62d4","status":"unaffected"},{"at":"8139c3ac7d388e0b3b008d1fb7d9bbdfabe252bb","status":"unaffected"},{"at":"691eb796f04e358adeae441b453dbfdc576ff7fe","status":"unaffected"},{"at":"1f727af81d89c50c76d4db1f6ece7db39653006d","status":"unaffected"}],"versionType":"git"}],"repo":"https://github.com/stolostron/multicluster-observability-addon","collectionURL":"https://github.com/stolostron/multicluster-observability-addon"},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.13","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126264","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.13::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.14","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126262","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.14::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.15","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126262","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.15::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.16","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126267","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.17","packageName":"rhacm2/acm-multicluster-observability-addon-rhel9","defaultStatus":"affected","versions":[{"version":"1789126264","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.17::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:67539","name":"RHSA-2026:67539","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67540","name":"RHSA-2026:67540","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67541","name":"RHSA-2026:67541","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67542","name":"RHSA-2026:67542","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67543","name":"RHSA-2026:67543","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89060","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531596","name":"RHBZ#2531596","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/stolostron/multicluster-observability-addon/pull/644"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-551","description":"Incorrect Behavior Order: Authorization Before Parsing and Canonicalization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-21T11:22:19.529Z"},"datePublic":"2026-09-10T00:00:00.000Z","x_redhatCweChain":"CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization","workarounds":[{"lang":"en","value":"Disable MCOA log-forwarding and tracing capabilities that use ClusterLogForwarder or OpenTelemetryCollector resources."}],"timeline":[{"lang":"en","time":"2026-09-10T18:31:57.158Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-10T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-11T16:31:51.529684Z","id":"CVE-2026-89060","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-11T20:30:32.165Z"}}]}}}