CVE-2026-75924

8.7 Élevée

Publiée le 18/08/2026 à 19:17 · Modifiée le 20/08/2026 à 15:08 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.

Traduire en français

Produits concernés

Red Hat Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes 2

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.7 Élevée	secalert@redhat.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-269

Références

https://access.redhat.com/security/cve/CVE-2026-75924
https://bugzilla.redhat.com/show_bug.cgi?id=2515720

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories