This vulnerability exists in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. It allows a privileged namespace administrator—who can create Channel and Subscription resources—to exploit improper authorization by manipulating the Channel.Spec.SecretRef.Namespace field. This manipulation causes the system to fetch and copy Secret contents from other namespaces into the attacker's namespace, leading to unauthorized disclosure of sensitive information. The root cause is that the component incorrectly honors tenant-controlled namespace references without proper access control validation. The vulnerability is tracked as CVE-2026-66878 with a CVSS 3.1 score of 7.7 (high severity) and is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). Red Hat has not yet provided an official fix or effective mitigation that meets their product security standards.

An attacker with namespace administrator privileges can exfiltrate sensitive Secret data from other namespaces within the Kubernetes cluster. This leads to a confidentiality breach, exposing potentially critical secrets such as credentials or tokens. The vulnerability does not impact integrity or availability. The scope is changed because the attacker can access resources outside their authorized namespace boundaries, resulting in horizontal privilege escalation within the cluster.

Currently, no official patch or mitigation is available that meets Red Hat's criteria for ease of use, applicability, or stability. Red Hat advises monitoring their advisory page for updates. Until a fix is released, organizations should carefully restrict namespace administrator privileges and limit the ability to create Channel and Subscription resources to trusted users only. Customers with Red Hat Technical Account Managers (TAM) can consult directly for tailored guidance. No generic mitigations are recommended by Red Hat at this time.