CVE-2026-73122 Red Hat CVE debrief

Who should care

Organizations using Red Hat Advanced Cluster Management (RHACM) and relying on the multicloud-operators-channel component should be aware of this vulnerability. Security teams and administrators responsible for cluster management and data security in RHACM environments need to assess their exposure and take appropriate actions.

Technical summary

The multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM) contains a flaw that allows a compromised agent from a managed cluster to access sensitive information. The agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This vulnerability has a CVSS score of 7.7 and is considered HIGH severity. Organizations using RHACM should assess their exposure and apply relevant patches or mitigations. The flaw is related to the handling of Secrets and ConfigMaps within Channel namespaces, and a compromised agent could exploit this to gain unauthorized access to sensitive information.

Defensive priority

Organizations using Red Hat Advanced Cluster Management (RHACM) should assess their exposure and apply relevant patches or mitigations.

Recommended defensive actions

• Review and apply patches or mitigations provided by Red Hat for the multicloud-operators-channel component in RHACM.
• Assess exposure by reviewing cluster configurations and namespaces.
• Implement compensating controls such as monitoring for unusual access patterns to Secrets and ConfigMaps.
• Verify that all Secrets and ConfigMaps are properly secured and accessed only by authorized entities.
• Consider inventory checks for affected components and ensure vendor remediation is applied.

Evidence notes

The vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information, specifically reading all Secrets and ConfigMaps within any Channel namespace on the hub. This could expose credentials for other tenants' Git and Helm repositories, leading to significant information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.