CVE-2026-70398

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70398", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-11T17:40:07.970Z", "datePublished": "2026-08-12T01:10:32.967Z", "dateUpdated": "2026-09-05T14:23:56.926Z"}, "containers": {"cna": {"title": "Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicloud-integrations-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787260689", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicloud-integrations-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787259106", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicloud-integrations-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787183407", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicloud-integrations-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787238604", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicloud-integrations-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787252179", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicloud-integrations-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787243221", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.17::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-70398", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514228", "name": "RHBZ#2514228", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-11T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "description": "Unintended Proxy or Intermediary ('Confused Deputy')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-05T14:23:56.926Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T12:36:04.216978Z", "id": "CVE-2026-70398", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:36:53.713Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70398", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T12:36:04.216978Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:36:48.437Z"}}], "cna": {"title": "Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787260689", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicloud-integrations-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787259106", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicloud-integrations-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1787183407", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicloud-integrations-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787238604", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicloud-integrations-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787252179", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicloud-integrations-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787243221", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicloud-integrations-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-08-11T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-70398", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514228", "name": "RHBZ#2514228", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-441", "description": "Unintended Proxy or Intermediary ('Confused Deputy')"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-05T14:23:56.926Z"}, "x_redhatCweChain": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')"}}, "cveMetadata": {"cveId": "CVE-2026-70398", "state": "PUBLISHED", "dateUpdated": "2026-09-05T14:23:56.926Z", "dateReserved": "2026-08-11T17:40:07.970Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-12T01:10:32.967Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.11::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicloud-integrations-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787260689", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.13::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicloud-integrations-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787259106", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.14::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicloud-integrations-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787183407", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.15::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicloud-integrations-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787238604", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.16::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicloud-integrations-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787252179", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.17::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicloud-integrations-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787243221", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en multicloud-integrations, un componente de Red Hat Advanced Cluster Management (RHACM). Esta vulnerabilidad permite a un usuario autenticado, referido como un inquilino, manipular el controlador GitOpsCluster. Al explotar esto, un inquilino puede redirigir tokens de portador sensibles de cl\u00fasteres spoke desde ubicaciones seguras a un espacio de nombres que controlan. Este acceso no autorizado a los tokens puede llevar a la divulgaci\u00f3n de informaci\u00f3n cr\u00edtica y eludir las pol\u00edticas de seguridad dentro de los AppProjects de ArgoCD."}], "id": "CVE-2026-70398", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70398", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T12:36:04.216978Z", "version": "2.0.3"}}]}, "published": "2026-08-12T02:16:38.060", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60386"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60387"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60388"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60389"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60390"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60391"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-70398"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514228"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "multicloud-integrations: multicloud-integrations: GitOpsCluster.spec.argoServer.argoNamespace writes spoke bearer tokens to attacker-chosen namespace", "id": "2514228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514228"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-441", "details": ["A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-70398", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/multicloud-integrations-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-70398\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-70398"], "statement": "Critical: A flaw in Red Hat Advanced Cluster Management's multicloud-integrations component allows a tenant to exfiltrate spoke cluster bearer tokens. This is due to the GitOpsCluster controller writing secrets to an attacker-chosen namespace, bypassing existing security guards, leading to privilege escalation and circumvention of ArgoCD AppProject constraints.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "original": {"product": "Red Hat Advanced Cluster Management for Kubernetes 2", "source": "cna", "vendor": "Red Hat"}, "product": "advanced_cluster_management_for_kubernetes", "vendor": "redhat"}], "created": "2026-08-12T15:15:02.673676+00:00", "updated": "2026-08-13T13:20:29.827533+00:00", "vendors": ["redhat", "redhat$PRODUCT$advanced_cluster_management_for_kubernetes"]}