01 Record

CVE-2026-67567

Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

CriticalPUBLISHEDCNA: redhat

Base score9.9 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

View raw JSON CVE Program record

02 Description

Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

03 Metadata

Published

2026-08-20 20:34Z1 DAY AGO

Last updated

2026-08-20 20:34Z1 DAY AGO

Reserved

2026-08-11

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Critical (CVSS 9.9)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-441Unintended Proxy or Intermediary ('Confused Deputy')Class

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

2164c5318c04d62943f6105ee51be053f8596d145c6c30ebd567a7d9443609b9

04 Affected products

VendorProductVersionsPlatforms

Red HatRed Hat Advanced Cluster Management for Kubernetes 2Not specified—

05 References

access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-67567vdb-entryx_refsource_REDHAT
bugzilla.redhat.comRHBZ#2514224https://bugzilla.redhat.com/show_bug.cgi?id=2514224issue-trackingx_refsource_REDHAT