{"id":"CVE-2026-89060","title":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources o…","summary":"A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources o…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-551"],"vendor":"Red Hat","product":"multicluster-observability-addon","affected":["multicluster-observability-addon < *","rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)","rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)","rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)","rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)","rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)"],"published":"2026-09-11","updated":"2026-09-21","sourceUpdated":"2026-09-21T12:17:23.503","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89060","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:67539","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67540","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67541","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67542","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67543","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89060","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531596","label":"secalert@redhat.com"},{"url":"https://github.com/stolostron/multicluster-observability-addon/pull/644","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89060.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89060"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89060"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T16:31:51.529684Z"},"epss":0.0027,"epssPercentile":0.194,"ingestedAt":"2026-09-14T11:11:19.882Z","patched":["advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17"],"slug":"CVE-2026-89060","body":"## Overview\n\nA cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:67540** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67540)\n- **RHSA-2026:67539** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67539)\n- **RHSA-2026:67541** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67541)\n- **RHSA-2026:67542** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67542)\n- **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}