CVE-2026-67567: Unintended Proxy or Intermediary ('Confused Deputy') in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability CVE-2026-67567 exists in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2.11. It arises because the HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without sufficient validation of tenant-created HelmRelease custom resources. This improper validation allows a tenant with the ability to create HelmRelease CRs to bypass existing security controls and deploy arbitrary resources across the entire Kubernetes cluster. The flaw is classified as a 'Confused Deputy' (CWE-441) vulnerability. The CVSS v3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Red Hat has published security advisories (RHSA-2026:60387 and RHSA-2026:60386) that include updated container images and fixes in later versions, notably in version 2.17 and 2.11.11, and recommends applying these updates to mitigate the vulnerability.

Successful exploitation of this vulnerability allows a tenant with limited privileges (ability to create HelmRelease CRs) to escalate privileges and deploy arbitrary resources across the entire Kubernetes cluster. This can lead to a complete compromise of cluster confidentiality, integrity, and availability. The vulnerability enables bypassing of existing security controls due to improper validation and elevated privileges used by the HelmRelease controller.

Red Hat has released updated container images and security updates for Red Hat Advanced Cluster Management for Kubernetes that address this vulnerability. Users should apply the relevant security updates as detailed in Red Hat advisories RHSA-2026:60386 and RHSA-2026:60387. Before applying updates, ensure all previously released errata relevant to the system are applied. Refer to Red Hat's official documentation for update procedures: https://access.redhat.com/articles/11258. There is no indication that no action is required or that the issue is already mitigated without updates. Patch status is confirmed by vendor advisories indicating fixes in newer versions.