Bug 2512105 (CVE-2026-19130)

Summary: CVE-2026-19130 provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedFrom labels bypasses authorization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: gparvin, rhaigner, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-06 15:15:18 UTC 
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). The controller propagates rotated provider credentials to child Secrets across namespaces based on copiedFrom* labels. The only authorization check is a SHA-256 hash comparison between the child Secret's data and the source Secret's prior (pre-rotation) data. An attacker with secrets:create permission in any namespace on the hub cluster can create a child Secret with matching copiedFrom labels pointing at a victim's source Secret. If the attacker knows the byte-exact prior credential value, the controller will overwrite their child Secret with the newly rotated credential on the next rotation cycle. This allows the attacker to intercept rotated provider credentials they should not have access to.

The vulnerability exists in controllers/providercredential/provider-credential-controller.go in the reconcileProviderCredentials function (lines 118-179). The controller performs a cluster-wide List of all Secrets matching copiedFrom labels (line 119-122) and uses only the hash gate (line 161) to authorize the credential push -- no namespace allowlist, ownerReference, or SubjectAccessReview is performed.

CWE-639: Authorization Bypass Through User-Controlled Key (the copiedFrom labels are the user-controlled authorization key). Also CWE-284: Improper Access Control.

Preconditions: (1) Attacker has secrets:create in any namespace on the hub. (2) Attacker possesses the byte-exact prior plaintext of the source provider Secret. (3) Hub admin performs a credential rotation on the source Secret.

Discovered via Red Hat ProdSec AI-assisted security assessment (Project Glasswing).