CVE-2026-70398 Red Hat CVE debrief

Who should care

Red Hat Advanced Cluster Management (RHACM) users, administrators, and security teams should be aware of this critical vulnerability and take immediate action to mitigate the risk.

Technical summary

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects. The CVSS score is 9.6, indicating a critical severity.

Defensive priority

Authenticated users with tenant privileges may be able to manipulate the GitOpsCluster controller, potentially redirecting sensitive spoke cluster bearer tokens.

Recommended defensive actions

• Review and restrict access to the GitOpsCluster controller
• Implement additional monitoring for suspicious activity related to spoke cluster bearer tokens
• Apply security patches or updates provided by Red Hat
• Verify and enforce proper configuration of ArgoCD AppProjects
• Conduct a thorough review of current security policies and update them as necessary
• Perform a detailed inventory of assets that may be affected by this vulnerability
• Establish a rollback plan in case of failed patch deployment

Evidence notes

The CVE-2026-70398 record indicates a critical vulnerability in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). An authenticated user, referred to as a tenant, may be able to manipulate the GitOpsCluster controller, potentially redirecting sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This could lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects. The CVSS score is 9.6, indicating a critical severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.