CVE-2026-73122 is a privilege escalation vulnerability in the multicloud-operators-channel component of RHACM. The issue arises because the Channel controller's auto-generated Role grants excessive permissions, allowing a compromised agent from a managed cluster to read all Secrets and ConfigMaps in any Channel namespace on the hub. This flaw results in unauthorized access to sensitive information, including credentials for other tenants' Git and Helm repositories. The vulnerability is classified under CWE-269 (Improper Privilege Management) and has a CVSS 3.1 base score of 7.7 (High) with network attack vector, low complexity, low privileges required, no user interaction, and scope changed. No official patch or mitigation meeting Red Hat's criteria is currently available.

A compromised managed-cluster agent can exploit this vulnerability to gain unauthorized read access to all Secrets and ConfigMaps within any Channel namespace on the hub. This can lead to exposure of sensitive credentials for Git and Helm repositories across tenants, resulting in significant information disclosure. The integrity and availability of the system are not impacted, but confidentiality is highly compromised.

Currently, Red Hat does not provide an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, and stability. Users should monitor Red Hat advisories for updates. Customers with a Technical Account Manager (TAM) or RHEL Security Select Add-on can seek direct guidance. Until a fix is released, limiting exposure by restricting access to managed-cluster agents and minimizing trust boundaries may help reduce risk, but no vendor-approved mitigation is available.