Bug 2507538 (CVE-2026-66793) - CVE-2026-66793 governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via ManagedClusterAddOn annotation enables RCE on spoke
Summary: CVE-2026-66793 governance-policy-addon-controller: governance-policy-addon-co...
Keywords:
Status: NEW
Alias: CVE-2026-66793
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-27 15:45 UTC by OSIDB Bzimport
Modified: 2026-08-18 14:29 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-27 15:45:44 UTC 
Each addon factory registers GetValuesFunc in an order where later functions override earlier ones. GetValuesFromAddonAnnotation (addon-framework pkg/addonfactory/helper.go:24-37) reads ManagedClusterAddOn annotations and returns them as Helm values, overriding the hardcoded image set by the operator's environment variable. mandateValues (registered last) only re-asserts replicas and uninstall — it does not re-assert the image. A user who can annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image to an attacker-controlled image, which then runs with cluster-admin privileges on the managed cluster.

Source: Project Glasswing AI-SAST audit of stolostron/governance-policy-addon-controller.
Finding ID: FIND-001
Assurance: execution_proven
Note: Live validation on running cluster did not reproduce (countersign conflict). Code-level vulnerability confirmed via static analysis.
Note You need to log in before you can comment on or make changes to this bug.