CVE-2026-73137: Exposure of Sensitive Information to an Unauthorized Actor in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability exists in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with permissions to create HelmRelease objects can exploit this flaw by manipulating the secretRef.Namespace field. This manipulation causes the GetSecret() function in the HelmRelease controller to retrieve Secrets from arbitrary namespaces, which are then exfiltrated to an attacker-controlled Helm repository. This leads to exposure of sensitive credentials from Secrets in namespaces beyond the attacker's authorization scope. The vulnerability has a CVSS 3.1 base score of 7.7 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and a confidentiality impact rated as high. The scope is changed, indicating impact beyond the vulnerable component.

Exploitation of this vulnerability allows an attacker with HelmRelease create permissions to exfiltrate sensitive credentials from Secrets in any namespace within the Kubernetes cluster. This unauthorized access to sensitive information can lead to significant confidentiality breaches, potentially compromising cluster security and operations. There is no impact on integrity or availability reported.

According to the Red Hat advisory, no effective mitigation or patch currently meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates or fixes. Until a fix is available, restricting HelmRelease create permissions to trusted tenants and minimizing the exposure of sensitive Secrets may reduce risk. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.