CVE-2026-89060

The multicluster-observability-addon component, which pushes metrics-collection configuration from a Kubernetes hub cluster (e.g., Red Hat Advanced Cluster Management for Kubernetes) out to managed clusters, fails to confine configuration-resource references to the requesting managed cluster's own namespace. As a result, a managed-cluster identity that authenticates to the hub can reference configuration resources in other namespaces, and hub Secrets referenced by those configurations are exposed to that cluster. An attacker who controls or has compromised a managed cluster can thereby read sensitive hub Secrets, consistent with the CVSS score of 7.7 (scope changed, high confidentiality impact, no integrity or availability impact; CWE-551, incorrect behavior order in handling cross-namespace references). Affected users are operators running Red Hat Advanced Cluster Management for Kubernetes or equivalent open-cluster-management deployments with the multicluster observability addon enabled. No public proof-of-concept is known, the flaw is not in CISA KEV, and there are no reports of in-the-wild exploitation.

What to do: Apply the fix per the Red Hat security advisory for multicluster-observability-addon once released (no fixed version number is provided in this data), then restart the addon agents on managed clusters. Until patched, audit which hub-cluster Secrets are referenced by observability configuration, rotate any hub Secrets that may have been delivered to less-trusted managed clusters, and review hub RBAC so managed-cluster identities cannot resolve references outside their namespace.