CVE-2026-70398

CriticalCVSS 9.6/10Last modified Oct 24, 2026

Description

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-441

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 12, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-703998.7Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to ca CVE-2026-70407.5Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify CVE-2026-704005.4Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token CVE-2026-704025.8Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permiss CVE-2026-704039.3XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected de CVE-2026-704056.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by send CVE-2026-704066.5Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:rep CVE-2026-704074.3Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, ca CVE-2026-704088.7An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileg CVE-2026-704096.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrad CVE-2026-70413.7A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the compone CVE-2026-704108.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantia