Bug 2507995 (CVE-2026-66800) - CVE-2026-66800 cluster-backup-operator: cluster-backup-operator: CleanupAll triggers unguarded cluster-wide mass-delete via operator ServiceAccount
Summary: CVE-2026-66800 cluster-backup-operator: cluster-backup-operator: CleanupAll t...
Keywords:
Status: NEW
Alias: CVE-2026-66800
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-28 13:52 UTC by OSIDB Bzimport
Modified: 2026-08-11 16:27 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-28 13:52:45 UTC 
The cluster-backup-operator supports a cleanupBeforeRestore field on the Restore CR with a CleanupAll option (api/v1beta1/restore_types.go:57-63). When CleanupAll is set, the operator relaxes its label selector to delete ALL ACM/Hive-labelled Secrets and ConfigMaps cluster-wide — including those without a restore label (restore_post.go:367 comment: "if cleanup is all, get all secrets, even the ones without a restore label"). Additionally, invokeDynamicDelete (restore_post.go:509-526) iterates discovered GVRs via the dynamic client and deletes objects not present in the current backup.

The CleanupBeforeRestore field has only +kubebuilder:validation:Required with no Enum or CEL restriction, and the validating webhook adds no guard on CleanupAll. A namespace-admin in open-cluster-management-backup can trigger cluster-wide deletion of ACM-managed resources by creating a Restore CR with cleanupBeforeRestore: CleanupAll, causing denial of service across the hub cluster.

Confirmed by static triage at SHA 7f488e2e. Root cause not addressed at HEAD 6248fd4.
Note You need to log in before you can comment on or make changes to this bug.