CVE-2026-18874

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:60386
https://access.redhat.com/errata/RHSA-2026:60387
https://access.redhat.com/errata/RHSA-2026:60388
https://access.redhat.com/errata/RHSA-2026:60389
https://access.redhat.com/errata/RHSA-2026:60390
https://access.redhat.com/errata/RHSA-2026:60391
https://access.redhat.com/security/cve/CVE-2026-18874
https://bugzilla.redhat.com/show_bug.cgi?id=2511115

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un fallo en volsync-addon-controller. Esta vulnerabilidad permite a un atacante inyectar código YAML (Yet Another Markup Language) malicioso en el recurso de Suscripción de OpenShift Lifecycle Manager (OLM). Esto se debe a un escape incorrecto de los valores de las anotaciones cuando se renderizan en YAML. Una explotación exitosa podría llevar a la modificación o el control no autorizados sobre las configuraciones de Suscripción de OLM, lo que podría afectar la gestión de software dentro del clúster. Este problema afecta principalmente a los sistemas donde la anotación ’volsync-addon-deploy-type: olm’ está explícitamente habilitada.

Information

Published : 2026-08-19 18:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-18874

Mitre link : CVE-2026-18874

CVE.ORG link : CVE-2026-18874

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-18874", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18874", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T19:54:04.444241Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 0.7}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787683560", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-volsync-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787266564", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-volsync-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1787266564", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-volsync-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787266360", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-volsync-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787266564", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-volsync-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787266556", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-volsync-addon-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-19T18:16:36.080", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-18874", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511115", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en volsync-addon-controller. Esta vulnerabilidad permite a un atacante inyectar c\u00f3digo YAML (Yet Another Markup Language) malicioso en el recurso de Suscripci\u00f3n de OpenShift Lifecycle Manager (OLM). Esto se debe a un escape incorrecto de los valores de las anotaciones cuando se renderizan en YAML. Una explotaci\u00f3n exitosa podr\u00eda llevar a la modificaci\u00f3n o el control no autorizados sobre las configuraciones de Suscripci\u00f3n de OLM, lo que podr\u00eda afectar la gesti\u00f3n de software dentro del cl\u00faster. Este problema afecta principalmente a los sistemas donde la anotaci\u00f3n \u2019volsync-addon-deploy-type: olm\u2019 est\u00e1 expl\u00edcitamente habilitada."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "secalert@redhat.com"}