CVE-2026-64927

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64927", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-11T17:40:07.973Z", "datePublished": "2026-08-12T01:12:08.474Z", "dateUpdated": "2026-09-05T17:07:35.199Z"}, "containers": {"cna": {"title": "Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787260663", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787259310", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787172840", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787238600", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242105", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242099", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.17::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-64927", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514229", "name": "RHBZ#2514229", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-11T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key", "workarounds": [{"lang": "en", "value": "Restrict the creation of `Channel` resources to trusted administrators within Red Hat Advanced Cluster Management. This limits the attack surface by preventing unauthorized tenants from exploiting the confused deputy vulnerability in the `multicloud-operators-channel` component."}], "timeline": [{"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-05T17:07:35.199Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T15:08:50.881307Z", "id": "CVE-2026-64927", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T16:57:43.646Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T15:08:50.881307Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T15:08:55.585Z"}}], "cna": {"title": "Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787260663", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787259310", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1787172840", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787238600", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787242105", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787242099", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-channel-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-08-11T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-64927", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514229", "name": "RHBZ#2514229", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Restrict the creation of `Channel` resources to trusted administrators within Red Hat Advanced Cluster Management. This limits the attack surface by preventing unauthorized tenants from exploiting the confused deputy vulnerability in the `multicloud-operators-channel` component."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-05T17:07:35.199Z"}, "x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key"}}, "cveMetadata": {"cveId": "CVE-2026-64927", "state": "PUBLISHED", "dateUpdated": "2026-09-05T17:07:35.199Z", "dateReserved": "2026-08-11T17:40:07.973Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-12T01:12:08.474Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.11::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787260663", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.13::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787259310", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.14::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787172840", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.15::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787238600", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.16::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242105", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.17::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-channel-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242099", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el componente multicloud-operators-channel. Esta vulnerabilidad permite a un usuario con permisos espec\u00edficos manipular c\u00f3mo el sistema maneja informaci\u00f3n sensible, conocida como Secrets, a trav\u00e9s de diferentes partes del sistema (namespaces). Al explotar esto, un atacante puede modificar estos Secrets en \u00e1reas no autorizadas. Esto podr\u00eda llevar a acceso no autorizado a informaci\u00f3n o privilegios elevados dentro del sistema."}], "id": "CVE-2026-64927", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64927", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T15:08:50.881307Z", "version": "2.0.3"}}]}, "published": "2026-08-12T02:16:37.780", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60386"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60387"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60388"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60389"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60390"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60391"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-64927"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514229"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "multicloud-operators-channel: multicloud-operators-channel: cross-namespace Secret and ConfigMap mutation via spec.secretRef.namespace confused deputy", "id": "2514229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514229"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system."], "mitigation": {"lang": "en:us", "value": "Restrict the creation of `Channel` resources to trusted administrators within Red Hat Advanced Cluster Management. This limits the attack surface by preventing unauthorized tenants from exploiting the confused deputy vulnerability in the `multicloud-operators-channel` component."}, "name": "CVE-2026-64927", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/multicluster-operators-channel-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64927\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64927"], "statement": "Moderate: A confused deputy flaw in the multicloud-operators-channel component of Red Hat Advanced Cluster Management allows a tenant with Channel create permissions to modify Secrets in arbitrary namespaces. This enables cross-namespace Secret mutation and backup-scope expansion, indicating a privilege escalation within the cluster.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 95.0, "source": "matching"}]}, "product": "acm", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "original": {"product": "Red Hat Advanced Cluster Management for Kubernetes 2", "source": "cna", "vendor": "Red Hat"}, "product": "advanced_cluster_management_for_kubernetes", "vendor": "redhat"}], "created": "2026-08-12T14:45:03.071957+00:00", "updated": "2026-08-13T13:20:24.849647+00:00", "vendors": ["redhat", "redhat$PRODUCT$acm", "redhat$PRODUCT$advanced_cluster_management_for_kubernetes"]}