2514224 – (CVE-2026-67567) CVE-2026-67567 multicloud-operators-subscription: multicloud-operators-subscription: HelmRelease chart applied with controller SA without GVK or namespace restriction

Bug 2514224 (CVE-2026-67567) - CVE-2026-67567 multicloud-operators-subscription: multicloud-operators-subscription: HelmRelease chart applied with controller SA without GVK or namespace restriction

Summary: CVE-2026-67567 multicloud-operators-subscription: multicloud-operators-subscr...

Keywords:
Status:	NEW
Alias:	CVE-2026-67567
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2026-08-11 17:38 UTC by OSIDB Bzimport
Modified:	2026-08-20 19:46 UTC (History)
CC List:	2 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description OSIDB Bzimport 2026-08-11 17:38:19 UTC

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). The HelmRelease controller's NewManager() function builds Helm action.Configuration using the controller's own kubeconfig without impersonation or SubjectAccessReview. No GVK filter or namespace coercion is applied, allowing cluster-scoped or cross-namespace Helm chart templates to be applied with the controller's wildcard (*/*/*) ServiceAccount privileges. A tenant who can create a HelmRelease CR can achieve arbitrary resource deployment cluster-wide.

Upstream repo: https://github.com/stolostron/multicloud-operators-subscription
Audited commit: 48ae4defaa5b719e0664e1de7413c96029c938bc
Jira tracker: ACM-38623

Note You need to log in before you can comment on or make changes to this bug.