CVE-2026-66793

Published: Aug 18, 2026Modified: Aug 27, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

https://access.redhat.com/errata/RHSA-2026:60386

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60387

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60388

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60389

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60390

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60391

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-66793

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2507538

Source: secalert@redhat.com

Timeline

No history available yet.