---
id: CVE-2026-89060
title: >-
  A cross-namespace authorization flaw in multicluster-observability-addon
  allows a user with permission to modify a managed cluster’s
  ManagedClusterAddOn configuration to reference ClusterLogForwarder or
  OpenTelemetryCollector resources o…
summary: >-
  A cross-namespace authorization flaw in multicluster-observability-addon
  allows a user with permission to modify a managed cluster’s
  ManagedClusterAddOn configuration to reference ClusterLogForwarder or
  OpenTelemetryCollector resources o…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-551
vendor: Red Hat
product: multicluster-observability-addon
affected:
  - multicluster-observability-addon < *
  - rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)
  - rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)
  - rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)
  - rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)
  - rhacm2/acm-multicluster-observability-addon-rhel9 (all versions)
published: '2026-09-11'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T12:17:23.503'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89060'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:67539'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67540'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67541'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67542'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67543'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89060'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2531596'
    label: secalert@redhat.com
  - url: 'https://github.com/stolostron/multicluster-observability-addon/pull/644'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89060.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89060'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89060'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T16:31:51.529684Z'
epss: 0.00475
epssPercentile: 0.38383
ingestedAt: '2026-09-14T11:11:19.882Z'
patched:
  - advanced_cluster_management_for_kubernetes 2.13
  - advanced_cluster_management_for_kubernetes 2.14
  - advanced_cluster_management_for_kubernetes 2.15
  - advanced_cluster_management_for_kubernetes 2.16
  - advanced_cluster_management_for_kubernetes 2.17
---

## Overview

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:67540** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67540)
- **RHSA-2026:67539** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67539)
- **RHSA-2026:67541** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67541)
- **RHSA-2026:67542** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67542)
- **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543)