This vulnerability (CVE-2026-64927) affects the multicloud-operators-channel component used in Red Hat Advanced Cluster Management. It is a confused deputy flaw (CWE-639) that enables a tenant with Channel create permissions to manipulate Secrets in arbitrary namespaces, effectively allowing cross-namespace Secret and ConfigMap mutation. This results in a change of scope and privilege escalation within the cluster. The flaw allows unauthorized modification of sensitive information (Secrets) across different namespaces, potentially leading to unauthorized access or elevated privileges. The CVSS 3.1 base score is 6.4 (medium severity) with network attack vector, low complexity, low privileges required, no user interaction, and scope change. Red Hat advises restricting the creation of Channel resources to trusted administrators as a mitigation.

An attacker with Channel create permissions can exploit this vulnerability to modify Secrets in namespaces they should not have access to, enabling unauthorized access to sensitive information and privilege escalation within the cluster. This impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, meaning the impact extends beyond the original security boundary.

Red Hat recommends restricting the creation of Channel resources to trusted administrators within Red Hat Advanced Cluster Management. This mitigation limits the attack surface by preventing unauthorized tenants from exploiting the confused deputy vulnerability. No official patch or fix is currently confirmed; therefore, organizations should apply this access control restriction until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.