CVE-2026-64927

MediumCVSS 6.4/10Last modified Oct 24, 2026

Description

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—

References

Timeline

Published: Aug 12, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-64933.5A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-p CVE-2026-649344.3The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently att CVE-2026-64945.3A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially cr CVE-2026-649408.6Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may a CVE-2026-649412.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim'CVE-2026-649438.1Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full A CVE-2026-649445.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects A CVE-2026-649457.5A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show ope CVE-2026-649467.4A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling sessio CVE-2026-649477.5A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitra CVE-2026-649487.1Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onward CVE-2026-649498.6Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandor