CVE-2026-67567: Unintended Proxy or Intermediary ('Confused Deputy') in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

This vulnerability arises from the multicloud-operators-subscription component's HelmRelease controller operating with excessive ServiceAccount privileges. A tenant able to create HelmRelease custom resources can exploit this to bypass namespace and Group-Version-Kind (GVK) restrictions, deploying arbitrary resources across the entire Kubernetes cluster. This unintended proxy or 'confused deputy' flaw (CWE-441) results in significant privilege escalation. The CVSS v3.1 score is 9.9 (critical) with network attack vector, low complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Red Hat advises restricting untrusted tenants from creating HelmRelease resources through strict RBAC policies. A security update is available in Red Hat Advanced Cluster Management for Kubernetes 2.17.1 and later.

The vulnerability enables a tenant with limited privileges (ability to create HelmRelease custom resources) to escalate privileges cluster-wide by deploying arbitrary resources using the HelmRelease controller's elevated ServiceAccount. This bypasses intended namespace and GVK restrictions, potentially compromising the entire Kubernetes cluster's confidentiality, integrity, and availability.

Red Hat recommends restricting the ability to create HelmRelease custom resources to trusted users only by implementing strict Role-Based Access Control (RBAC) policies. This prevents untrusted tenants from exploiting the controller's elevated privileges. Additionally, applying the security update available in Red Hat Advanced Cluster Management for Kubernetes version 2.17.1 or later addresses this vulnerability. Ensure all relevant previously released errata are applied before updating.