CVE-2026-75924
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Multicluster Engine for Kubernetes
- Vendor
- Red Hat
- Product
- Multicluster Engine for Kubernetes
- Platforms
- Unknown
- Default status
affected- Package
- multicluster-engine/managed-serviceaccount-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Advanced Cluster Management for Kubernetes 2
- Vendor
- Red Hat
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2
- Platforms
- Unknown
- Default status
unaffected- Package
- rhacm2/acm-cluster-permission-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Advanced Cluster Management for Kubernetes 2
- Vendor
- Red Hat
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2
- Platforms
- Unknown
- Default status
unaffected- Package
- rhacm2/mtv-integrations-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.