CVE-2026-73137

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73137", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-11T17:40:07.955Z", "datePublished": "2026-08-20T20:34:13.056Z", "dateUpdated": "2026-09-05T14:24:51.220Z"}, "containers": {"cna": {"title": "Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787263584", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787263693", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787170830", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787240030", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242321", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242108", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.17::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-73137", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514223", "name": "RHBZ#2514223", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-11T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-05T14:24:51.220Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T15:41:12.138460Z", "id": "CVE-2026-73137", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T15:42:53.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73137", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T15:41:12.138460Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T15:42:22.028Z"}}], "cna": {"title": "Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787263584", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787263693", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14.0", "versions": [{"status": "unaffected", "version": "1787170830", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787240030", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787242321", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787242108", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-08-11T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-73137", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514223", "name": "RHBZ#2514223", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-05T14:07:26.093Z"}, "x_redhatCweChain": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}}, "cveMetadata": {"cveId": "CVE-2026-73137", "state": "PUBLISHED", "dateUpdated": "2026-09-05T14:07:26.093Z", "dateReserved": "2026-08-11T17:40:07.955Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-20T20:34:13.056Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.11::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787263584", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.13::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787263693", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.14::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787170830", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.15::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787240030", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.16::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242321", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.17::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242108", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el componente multicloud-operators-subscription de Red Hat Advanced Cluster Management (RHACM). Un inquilino con permisos de creaci\u00f3n de HelmRelease puede explotar esta vulnerabilidad manipulando el campo \u2019secretRef.Namespace\u2019. Esto permite que la funci\u00f3n \u2019GetSecret()\u2019 en el controlador de HelmRelease recupere credenciales sensibles de cualquier espacio de nombres, las cuales luego se env\u00edan a un repositorio Helm controlado por el atacante. Esto puede conducir a la exfiltraci\u00f3n de credenciales de Secrets de espacios de nombres arbitrarios, lo que resulta en revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-73137", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73137", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T15:41:12.138460Z", "version": "2.0.3"}}]}, "published": "2026-08-20T21:17:09.270", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60386"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60387"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60388"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60389"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60390"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60391"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-73137"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514223"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "Red Hat Advanced Cluster Management for Kubernetes 2", "source": "cna", "vendor": "Red Hat"}, "product": "advanced_cluster_management_for_kubernetes", "vendor": "redhat"}], "created": "2026-08-21T01:30:05.840159+00:00", "updated": "2026-08-21T13:00:43.361576+00:00", "vendors": ["redhat", "redhat$PRODUCT$advanced_cluster_management_for_kubernetes"]}