CVE-2026-18874: Improper Control of Generation of Code ('Code Injection') in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

This vulnerability arises from improper escaping of annotation values in the volsync-addon-controller, enabling injection of malicious YAML code into the OpenShift Lifecycle Manager Subscription resource. This flaw allows attackers with appropriate privileges to alter OLM Subscription configurations, potentially compromising software management in Kubernetes clusters managed by Red Hat Advanced Cluster Management. The issue specifically impacts deployments with the 'volsync-addon-deploy-type: olm' annotation enabled. Red Hat's advisories for versions 2.11 and 2.17 indicate that security updates have been released to address this and other vulnerabilities.

Successful exploitation could allow an attacker to inject malicious configuration code into OLM Subscription resources, leading to unauthorized modification or control over software management within the Kubernetes cluster. This could affect cluster stability and security by altering lifecycle management processes. The CVSS score of 6.2 reflects a medium severity with low confidentiality impact but high integrity and availability impact. No known exploits in the wild have been reported.

Red Hat has released security updates for Red Hat Advanced Cluster Management for Kubernetes, including versions 2.17.1 and 2.11.11, which address this vulnerability. Users should apply these official updates following Red Hat's guidance to remediate the issue. Ensure that all previously released errata relevant to your system are applied before updating. Refer to Red Hat's official documentation and advisories for detailed update instructions. No additional mitigation steps are indicated beyond applying the vendor-provided fixes.