CVE-2026-89060 Red Hat CVE debrief

Who should care

Defenders managing Red Hat Advanced Cluster Management for Kubernetes 2 should assess exposure and prioritize verification of managed cluster configurations and access controls. They should also review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and retest remediated assets.

Why it matters

CVE-2026-89060 is a high-severity vulnerability in multicluster-observability-addon that allows cross-namespace authorization flaws. Defenders managing Red Hat Advanced Cluster Management for Kubernetes 2 should assess exposure and prioritize verification of managed cluster configurations and access controls. The vulnerability could lead to unauthorized access to sensitive resources and potential copying of Secrets to attacker-controlled clusters. Verification and restriction of access, as well as applying patches, are crucial defensive actions.

• Potential unauthorized access to sensitive resources like ClusterLogForwarder, OpenTelemetryCollector, and Secrets
• Possible copying of Secrets to attacker-controlled managed clusters
• Need for verification and restriction of access to managed cluster configurations
• Priority for applying patches provided by Red Hat for affected products

Technical summary

The multicluster-observability-addon has a cross-namespace authorization flaw. A user with permission to modify a managed cluster’s ManagedClusterAddOn configuration can reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If these resources reference Secrets, the add-on may copy these Secrets to the attacker-controlled managed cluster. This vulnerability affects Red Hat Advanced Cluster Management for Kubernetes 2. Defenders should assess exposure and prioritize verification of managed cluster configurations and access controls.

Defensive priority

Defenders should prioritize verifying and restricting access to managed cluster configurations, especially for users with modify permissions. They should also monitor for and limit cross-namespace references to sensitive resources like ClusterLogForwarder, OpenTelemetryCollector, and Secrets.

Recommended defensive actions

• Verify and restrict access to managed cluster configurations
• Monitor for and limit cross-namespace references to sensitive resources
• Apply patches provided by Red Hat for affected products
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the cross-namespace authorization flaw in multicluster-observability-addon. Red Hat has released several errata related to this vulnerability, indicating affected products and providing patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.