CVE-2026-70398

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects.

Scoring

Severity

CRITICAL

CVSS base score

9.6

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS probability

0.32%

CWE

CWE-441

Published

2026-08-12

Last modified

2026-09-05

Affected products

• Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
• Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
• Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17
• Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
• Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Weakness type

• CWE-441

Related vulnerabilities

• CVE-2026-87502 — Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who...
• CVE-2026-87582 — Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
• CVE-2026-87442 — Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who...
• CVE-2026-87453 — Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote...
• CVE-2026-69531 — Microsoft Windows Speech Tampering Vulnerability
• CVE-2026-86600 — Workload identity attestation generated before login host validation in Snowflake drivers
• CVE-2026-86115 — Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
• CVE-2026-84329 — Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed...

Markdown version · Browse all CVEs