CVE-2026-73137: Exposure of Sensitive Information to an Unauthorized Actor in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

This vulnerability exists in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2.11. It allows a tenant with HelmRelease create permissions to exploit the manipulation of the secretRef.Namespace field. By doing so, the GetSecret() function in the HelmRelease controller can fetch sensitive credentials from arbitrary namespaces. These credentials are then exfiltrated to an attacker-controlled Helm repository, resulting in exposure of sensitive information. The issue is classified under CWE-200 (Exposure of Sensitive Information).

Successful exploitation leads to the disclosure of sensitive credentials from arbitrary namespace Secrets within the Kubernetes environment managed by Red Hat Advanced Cluster Management. This can compromise confidentiality but does not affect integrity or availability directly. The attacker must have HelmRelease create permissions, which implies some level of privilege within the cluster.

Red Hat has issued security advisories (RHSA-2026:60387) indicating an important security update for Red Hat Advanced Cluster Management for Kubernetes 2.11.11 that addresses this and other vulnerabilities. Users should apply the update to version 2.11.11 or later to remediate this issue. Before applying the update, ensure all previously released relevant errata are applied. Refer to Red Hat's official guidance on applying updates at https://access.redhat.com/articles/11258. Patch status is confirmed as an official fix is available in the updated container images for version 2.11.11.