RH
Product
Red Hat Advanced Cluster Management for Kubernetes 2.17
45
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 13High 19Medium 13Low 0
Watch
Add Red Hat Advanced Cluster Management for Kubernetes 2.17 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-66793 | 8.8 | Aug 18 | Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke Affected: All versions, or not specified |
| CVE-2026-70495 | 8.8 | Aug 17 | Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters Affected: All versions, or not specified |
| CVE-2026-66787 | 8.7 | Aug 20 | Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses Affected: All versions, or not specified |
| CVE-2026-66785 | 8.7 | Aug 20 | Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack Affected: All versions, or not specified |
| CVE-2026-71473 | 8.5 | Aug 12 | Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke Affected: All versions, or not specified |
| CVE-2026-76139 | 8.0 | Aug 19 | Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials Affected: All versions, or not specified |
| CVE-2026-89060 | 7.7 | Sep 11 | Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references Affected: All versions, or not specified |
| CVE-2026-73137 | 7.7 | Aug 20 | Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace Affected: All versions, or not specified |
| CVE-2026-73122 | 7.7 | Aug 12 | Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces Affected: All versions, or not specified |
| CVE-2026-66878 | 7.7 | Aug 12 | Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration Affected: All versions, or not specified |
| CVE-2026-71845 | 7.7 | Aug 11 | Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault() Affected: All versions, or not specified |
| CVE-2026-71469 | 7.5 | Aug 12 | Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos Affected: All versions, or not specified |
| CVE-2026-71467 | 7.5 | Aug 11 | Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing Affected: All versions, or not specified |
| CVE-2026-13676 | 7.5 | Jun 29 | fast-uri vulnerable to host confusion via failed IDN canonicalization Affected: All versions, or not specified |
| CVE-2026-46385 | 7.5 | May 29 | iskorotkov/avro: CPU Exhaustion in Avro Decoder Affected: All versions, or not specified |
| CVE-2026-46384 | 7.5 | May 29 | iskorotkov/avro: Integer Overflow in Avro Decoder Affected: All versions, or not specified |
| CVE-2026-42154 | 7.5 | May 4 | Prometheus: remote read endpoint allows denial of service via crafted snappy payload Affected: All versions, or not specified |
| CVE-2026-42151 | 7.5 | May 4 | Prometheus Azure AD remote write OAuth client secret exposed via config API Affected: All versions, or not specified |
| CVE-2026-71474 | 7.1 | Aug 11 | Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response Affected: All versions, or not specified |
Showing 19