CVE-2026-18874: Improper Control of Generation of Code ('Code Injection') in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.
AI Analysis
Technical Summary
This vulnerability arises from improper escaping of annotation values in the volsync-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes 2. Specifically, malicious YAML code can be injected into the OpenShift Lifecycle Manager (OLM) Subscription resource when the 'volsync-addon-deploy-type: olm' annotation is explicitly set. This improper control of code generation (CWE-94) can lead to unauthorized modification or control over OLM Subscription configurations, potentially affecting cluster software management. The vulnerability requires high privileges (cluster-admin or addon-management RBAC) to modify ManagedClusterAddOn annotations, and user interaction is not required. The default Helm deployment type since ACM 2.13 does not enable the vulnerable annotation, reducing exposure. No official patch or fix is currently stated in the vendor advisory; however, mitigation is possible by avoiding explicit setting of the vulnerable annotation.
Potential Impact
Exploitation of this vulnerability can result in unauthorized modification or control of OLM Subscription configurations within the Kubernetes cluster, potentially impacting software management and cluster operations. The integrity and availability impacts are high, while confidentiality impact is low. The attack requires network access, high privileges, and has high attack complexity, with no user interaction needed. Because the vulnerable annotation is not enabled by default since ACM 2.13, the attack surface is limited. There are no known exploits in the wild at this time.
Mitigation Recommendations
The vendor advisory states that to mitigate this vulnerability, ensure that the 'volsync-addon-deploy-type' annotation is not explicitly set to 'olm'. The default Helm deployment type for volsync-addon-controller in Red Hat Advanced Cluster Management for Kubernetes since ACM 2.13 does not enable this annotation and is not affected. No official patch or fix is currently available. Users should verify their deployments do not explicitly enable the vulnerable annotation to avoid exposure.
CVE-2026-18874: Improper Control of Generation of Code ('Code Injection') in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Description
A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.
CVSS v3.1
Score 6.2medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper escaping of annotation values in the volsync-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes 2. Specifically, malicious YAML code can be injected into the OpenShift Lifecycle Manager (OLM) Subscription resource when the 'volsync-addon-deploy-type: olm' annotation is explicitly set. This improper control of code generation (CWE-94) can lead to unauthorized modification or control over OLM Subscription configurations, potentially affecting cluster software management. The vulnerability requires high privileges (cluster-admin or addon-management RBAC) to modify ManagedClusterAddOn annotations, and user interaction is not required. The default Helm deployment type since ACM 2.13 does not enable the vulnerable annotation, reducing exposure. No official patch or fix is currently stated in the vendor advisory; however, mitigation is possible by avoiding explicit setting of the vulnerable annotation.
Potential Impact
Exploitation of this vulnerability can result in unauthorized modification or control of OLM Subscription configurations within the Kubernetes cluster, potentially impacting software management and cluster operations. The integrity and availability impacts are high, while confidentiality impact is low. The attack requires network access, high privileges, and has high attack complexity, with no user interaction needed. Because the vulnerable annotation is not enabled by default since ACM 2.13, the attack surface is limited. There are no known exploits in the wild at this time.
Mitigation Recommendations
The vendor advisory states that to mitigate this vulnerability, ensure that the 'volsync-addon-deploy-type' annotation is not explicitly set to 'olm'. The default Helm deployment type for volsync-addon-controller in Red Hat Advanced Cluster Management for Kubernetes since ACM 2.13 does not enable this annotation and is not affected. No official patch or fix is currently available. Users should verify their deployments do not explicitly enable the vulnerable annotation to avoid exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-04T17:21:18.911Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-18874","vendor":"Red Hat"}]
Threat ID: 6a85f0f8acd9273b496dcae6
Added to database: 08/19/2026, 18:07:52 UTC
Last enriched: 08/19/2026, 18:25:12 UTC
Last updated: 08/19/2026, 23:22:56 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.