---
id: CVE-2026-64927
title: A flaw was found in the multicloud-operators-channel component
summary: >-
  A flaw was found in the multicloud-operators-channel component. This
  vulnerability allows a user with specific permissions to manipulate how the
  system handles sensitive information, known as Secrets, across different parts
  of the system…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-639
published: '2026-08-12'
updated: '2026-09-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64927'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:60386'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60387'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60388'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60389'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60390'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60391'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64927'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2514229'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64927.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64927'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64927'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00189
epssPercentile: 0.08738
ingestedAt: '2026-09-05T16:41:56.483Z'
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2.11
affected:
  - advanced_cluster_management_for_kubernetes 2.11
  - advanced_cluster_management_for_kubernetes 2.13
  - advanced_cluster_management_for_kubernetes 2.14
  - advanced_cluster_management_for_kubernetes 2.15
  - advanced_cluster_management_for_kubernetes 2.16
  - advanced_cluster_management_for_kubernetes 2.17
patched:
  - advanced_cluster_management_for_kubernetes 2.11
  - advanced_cluster_management_for_kubernetes 2.13
  - advanced_cluster_management_for_kubernetes 2.14
  - advanced_cluster_management_for_kubernetes 2.15
  - advanced_cluster_management_for_kubernetes 2.16
  - advanced_cluster_management_for_kubernetes 2.17
---

## Overview

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)
- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)
- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)
- **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389)
- **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391)
- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)