CVE-2026-89060 Red Hat CVE debrief

Who should care

Defenders managing multicluster-observability-addon configurations, especially those with users having permissions to modify ManagedClusterAddOn configurations, should assess exposure and verify mitigation.

Why it matters

Defenders should care about CVE-2026-89060 because it allows unauthorized access to ClusterLogForwarder or OpenTelemetryCollector resources, potentially leading to sensitive information disclosure. Users with permission to modify ManagedClusterAddOn configurations are at risk, and verifying and mitigating this vulnerability is crucial.

• Potential unauthorized access to sensitive information through Secrets.
• Possible lateral movement within the cluster using copied Secrets.
• Need for verification of current configurations and permissions.
• Requirement to restrict and monitor user access to ManagedClusterAddOn configurations.

Technical summary

The vulnerability exists in the multicluster-observability-addon, where a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration can reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If these resources reference Secrets, the add-on may copy these Secrets to the attacker-controlled managed cluster. This could lead to unauthorized access to sensitive information and potential lateral movement within the cluster. Defenders should assess exposure and verify mitigation, especially in environments where users have permission to modify ManagedClusterAddOn configurations.

Defensive priority

Defenders should prioritize verifying and mitigating the vulnerability in multicluster-observability-addon, especially in environments where users have permission to modify ManagedClusterAddOn configurations.

Recommended defensive actions

• Verify the configuration of ManagedClusterAddOn in multicluster-observability-addon to prevent unauthorized access to ClusterLogForwarder or OpenTelemetryCollector resources.
• Restrict permissions to modify ManagedClusterAddOn configurations to trusted users only.
• Monitor for any suspicious activity related to Secret copying in managed clusters.
• Review and update the addon’s configuration to ensure proper namespace isolation.
• Perform an inventory of systems using multicluster-observability-addon to identify potential exposure.
• Review logs and monitoring data for signs of unauthorized access or suspicious activity.
• Implement additional compensating controls to limit the impact of a potential breach.

Evidence notes

The CVE record and NVD entry provide details on the cross-namespace authorization flaw in multicluster-observability-addon. Red Hat has provided references to their security advisory and bugzilla entry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.