CVE-2026-73122

{"id": "CVE-2026-73122", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73122", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T15:16:07.171624Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787260663", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787259310", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1787172840", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787238600", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787242105", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787242099", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-12T02:16:38.330", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-73122", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514230", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el componente multicloud-operators-channel de Red Hat Advanced Cluster Management (RHACM). Esta vulnerabilidad permite que un agente comprometido de un cl\u00faster gestionado obtenga acceso no autorizado a informaci\u00f3n sensible. Espec\u00edficamente, el agente puede leer todos los Secrets y ConfigMaps dentro de cualquier espacio de nombres de Channel en el hub, exponiendo potencialmente credenciales para los repositorios Git y Helm de otros inquilinos. Esto podr\u00eda llevar a una revelaci\u00f3n de informaci\u00f3n significativa."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "secalert@redhat.com"}