CVE-2026-89060: Red Hat Advanced Cluster Management For Kubernetes 2.13

High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days.

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Affected products

• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.13: before 1789126264 (fixed in 1789126264)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.14: before 1789126262 (fixed in 1789126262)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.15: before 1789126262 (fixed in 1789126262)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.16: before 1789126267 (fixed in 1789126267)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.17: before 1789126264 (fixed in 1789126264)

Published 2026-09-11. Last modified 2026-09-21.