This vulnerability (CVE-2026-64927) affects the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2. It is an authorization bypass (CWE-639) where a tenant with Channel create permissions can manipulate how Secrets are handled across namespaces, allowing cross-namespace Secret and ConfigMap mutation. This confused deputy flaw results in privilege escalation within the cluster by expanding backup scope and enabling unauthorized Secret modifications. The CVSS v3.1 base score is 6.4 (medium severity) with network attack vector, low complexity, low privileges required, no user interaction, and scope change. Red Hat’s advisory recommends restricting Channel resource creation to trusted administrators as a mitigation. No patch or official fix status is currently provided in the advisory.

An attacker with Channel create permissions can modify Secrets in arbitrary namespaces, potentially gaining unauthorized access to sensitive information or escalating privileges within the Kubernetes cluster. This could compromise confidentiality and integrity of cluster secrets but does not affect availability. The vulnerability enables horizontal and vertical privilege escalation within the cluster environment.

Red Hat advises restricting the creation of Channel resources to trusted administrators only within Red Hat Advanced Cluster Management. This limits the attack surface and prevents unauthorized tenants from exploiting the confused deputy vulnerability. No official patch or fix is currently confirmed; therefore, applying this access control restriction is the primary mitigation until a fix is released. Users should monitor the Red Hat advisory for updates on patch availability.