8.8

CVE-2026-66793

Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.11
Default Statusaffected
Version 1787683327
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.13
Default Statusaffected
Version 1787259078
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.14
Default Statusaffected
Version 1787080755
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.15
Default Statusaffected
Version 1787238535
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.16
Default Statusaffected
Version 1787080753
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.17
Default Statusaffected
Version 1787227696
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.57% 0.449
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://access.redhat.com/security/cve/CVE-2026-66793
https://bugzilla.redhat.com/show_bug.cgi?id=2507538
https://access.redhat.com/errata/RHSA-2026:60386
https://access.redhat.com/errata/RHSA-2026:60389
https://access.redhat.com/errata/RHSA-2026:60390
https://access.redhat.com/errata/RHSA-2026:60387
https://access.redhat.com/errata/RHSA-2026:60388
https://access.redhat.com/errata/RHSA-2026:60391