CVE-2026-66793: Red Hat Advanced Cluster Management For Kubernetes 2.11

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.

Affected products

• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.11: before 1787683327 (fixed in 1787683327)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.13: before 1787259078 (fixed in 1787259078)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.14: before 1787080755 (fixed in 1787080755)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.15: before 1787238535 (fixed in 1787238535)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.16: before 1787080753 (fixed in 1787080753)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.17: before 1787227696 (fixed in 1787227696)

Published 2026-08-18. Last modified 2026-08-27.