CVE-2026-89060

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Sep 11, 2026
Source updated: Sep 21, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

multicluster-observability-addon

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: affected
Package: multicluster-observability-addon
Package collection: https://github.com/stolostron/multicluster-observability-addon

multicluster-observability-addon · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	git	*	Unavailable	`ad36a3ba9fd946c04de71621e47486f7aa2634fd` → `unaffected` `683191e26a0ecb1a36d3e58470f1c1bed1ba62d4` → `unaffected` `8139c3ac7d388e0b3b008d1fb7d9bbdfabe252bb` → `unaffected` `691eb796f04e358adeae441b453dbfdc576ff7fe` → `unaffected` `1f727af81d89c50c76d4db1f6ece7db39653006d` → `unaffected`

Red Hat Advanced Cluster Management for Kubernetes 2.13

Vendor: Red Hat
Product: Red Hat Advanced Cluster Management for Kubernetes 2.13
Platforms: Unknown
Default status: affected
Package: rhacm2/acm-multicluster-observability-addon-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Advanced Cluster Management for Kubernetes 2.13 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1789126264	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Advanced Cluster Management for Kubernetes 2.14

Vendor: Red Hat
Product: Red Hat Advanced Cluster Management for Kubernetes 2.14
Platforms: Unknown
Default status: affected
Package: rhacm2/acm-multicluster-observability-addon-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Advanced Cluster Management for Kubernetes 2.14 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1789126262	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Advanced Cluster Management for Kubernetes 2.15

Vendor: Red Hat
Product: Red Hat Advanced Cluster Management for Kubernetes 2.15
Platforms: Unknown
Default status: affected
Package: rhacm2/acm-multicluster-observability-addon-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Advanced Cluster Management for Kubernetes 2.15 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1789126262	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Advanced Cluster Management for Kubernetes 2.16

Vendor: Red Hat
Product: Red Hat Advanced Cluster Management for Kubernetes 2.16
Platforms: Unknown
Default status: affected
Package: rhacm2/acm-multicluster-observability-addon-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Advanced Cluster Management for Kubernetes 2.16 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1789126267	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Advanced Cluster Management for Kubernetes 2.17

Vendor: Red Hat
Product: Red Hat Advanced Cluster Management for Kubernetes 2.17
Platforms: Unknown
Default status: affected
Package: rhacm2/acm-multicluster-observability-addon-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Advanced Cluster Management for Kubernetes 2.17 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1789126264	`unaffected`	rpm	*	Unavailable	None listed