CVE-2026-66878 is a vulnerability in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management. A privileged user with namespace administrator rights who can create Channel and Subscription resources can exploit this flaw by manipulating the Channel.Spec.SecretRef.Namespace field. This causes the system to copy sensitive Secret contents from other namespaces into the attacker's namespace, resulting in unauthorized information disclosure. The vulnerability arises because the component incorrectly honors tenant-controlled namespace references when fetching and copying Secret contents. This issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

The vulnerability allows a namespace administrator with the ability to create Channel and Subscription resources to bypass authorization controls and access sensitive Secret data from other namespaces within the cluster. This leads to a confidentiality breach with high impact. There is no impact on integrity or availability. The scope of the vulnerability is changed, meaning the breach affects resources beyond the attacker's namespace.

Currently, there is no available fix or mitigation that meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is released, environments where untrusted namespace administrators have permissions to create Channel and Subscription resources remain at risk. Consider restricting such permissions where possible as a temporary measure.