Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction
Summary
| CVE | CVE-2026-67567 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-20 21:17:07 UTC |
| Updated | 2026-08-28 21:17:10 UTC |
| Description | A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise. |
Risk And Classification
Primary CVSS: v3.1 9.9 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.004280000 probability, percentile 0.356810000 (date 2026-08-31)
Problem Types: CWE-441 | CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.11 | unaffected 1787263584 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.13 | unaffected 1787263693 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.14 | unaffected 1787170830 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.15 | unaffected 1787240030 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1787242321 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.17 | unaffected 1787242108 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:60389 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:60388 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:60387 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:60390 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-67567 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:60391 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:60386 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-11T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-08-11T00:00:00.000Z | Made public. |
Workarounds
CNA: To mitigate this issue, restrict the ability of untrusted tenants to create `HelmRelease` custom resources within the cluster. Implement strict Role-Based Access Control (RBAC) policies to limit which users or service accounts can create or modify `HelmRelease` objects. This will prevent unauthorized users from leveraging the controller's elevated privileges for cluster-wide resource deployment.
There are currently no legacy QID mappings associated with this CVE.