Bug 2507994 (CVE-2026-66799) - CVE-2026-66799 cluster-backup-operator: cluster-backup-operator: Restore.spec.namespaceMapping pass-through enables cross-namespace Secret/ConfigMap placement
Summary: CVE-2026-66799 cluster-backup-operator: cluster-backup-operator: Restore.spec...
Keywords:
Status: NEW
Alias: CVE-2026-66799
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-28 13:52 UTC by OSIDB Bzimport
Modified: 2026-08-11 16:26 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-28 13:52:37 UTC 
The cluster-backup-operator passes Restore.spec.namespaceMapping verbatim into the Velero Restore object (controllers/restore.go:878-880) with no restriction on target namespaces. The same function hardcodes ExistingResourcePolicy=update (line 856), so name-colliding resources in the mapped target namespace are overwritten.

The credentials backup (controllers/backup.go:123-126) contains Secret and ConfigMap objects from ACM/Hive-labelled namespaces including cloud-provider credentials, pull secrets, and ManagedServiceAccount tokens. A namespace-admin in open-cluster-management-backup can create a Restore CR with a namespaceMapping that redirects these credential Secrets into any target namespace — including namespaces the attacker controls — providing a cross-namespace write primitive for credential material.

The validating webhook (restore_webhook.go:80-91) and CRD validation never inspect NamespaceMapping targets.

Confirmed by static triage at SHA 7f488e2e and live validation. Root cause not addressed at HEAD 6248fd4.
Note You need to log in before you can comment on or make changes to this bug.