CVE-2026-75924

HighCVSS 8.7/10Last modified Aug 20, 2026

Description

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Multicluster Engine for Kubernetes	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—

References

Timeline

Published: Aug 18, 2026
Last modified: Aug 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-759259.6Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. CVE-2026-759268.6Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS CVE-2026-759277.2The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to P CVE-2026-759285.3The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allo CVE-2026-75937.3A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0. This impacts the function execute_com CVE-2026-759304.3The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and in CVE-2026-759317.5fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-CVE-2026-759328.6Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuratio CVE-2026-759337.3Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is execute CVE-2026-759357.5Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial CVE-2026-759367.5Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actor CVE-2026-759379.4A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating