CVE-2026-76139: Inclusion of Functionality from Untrusted Control Sphere in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.11 involves the acm-operator-bundle build process executing an unverified remote script. This script gains access to sensitive credentials used during the build, including GitHub access tokens and registry passwords. An attacker exploiting this flaw could inject malicious code into the build environment, leading to unauthorized access to build resources and potential compromise of the operator bundle's integrity. The issue is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). Red Hat has acknowledged the vulnerability but currently does not offer a fix or mitigation that meets their standards. The CVSS v3.1 score is 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a high-severity network attack requiring high privileges and resulting in significant confidentiality, integrity, and availability impacts.

Exploitation of this vulnerability allows a remote attacker to execute unverified code with elevated privileges in the build environment. This can lead to unauthorized access to sensitive credentials such as GitHub tokens and registry passwords, enabling compromise of build resources and the operator bundle. The integrity of the resulting operator bundle may be compromised, potentially affecting downstream deployments that rely on this bundle. The vulnerability impacts confidentiality, integrity, and availability of the build process and artifacts.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. Users are advised to monitor Red Hat advisories for updates. Until a fix is available, organizations should consider restricting access to the build environment and carefully auditing build processes to minimize exposure to untrusted scripts. Coordination with Red Hat Technical Account Managers (TAM) is recommended for affected customers. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.