CVE-2026-18874: Improper Control of Generation of Code ('Code Injection') in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability exists in the volsync-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes 2.11. Improper escaping of annotation values when rendered into YAML allows an attacker to inject malicious YAML code into the OLM Subscription resource. Exploitation requires the 'volsync-addon-deploy-type: olm' annotation to be explicitly set, which is not the default in versions since ACM 2.13. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially affecting software management within the Kubernetes cluster. The flaw is classified under CWE-94 (Improper Control of Generation of Code, 'Code Injection').

An attacker with high privileges who can modify ManagedClusterAddOn annotations can inject malicious YAML code into OLM Subscription resources, leading to unauthorized modification or control of subscription configurations. This can impact the integrity and availability of software management within the cluster. Confidentiality impact is low, but integrity and availability impacts are high. The attack complexity is high and requires no user interaction.

To mitigate this vulnerability, ensure that the 'volsync-addon-deploy-type' annotation is not explicitly set to 'olm'. The default Helm deployment type for volsync-addon-controller in Red Hat Advanced Cluster Management for Kubernetes since ACM 2.13 does not use this annotation and is not affected by this flaw. Therefore, upgrading to ACM 2.13 or later or avoiding the explicit use of the 'volsync-addon-deploy-type: olm' annotation effectively mitigates this issue.