CVE Tools
Track your stack

Red Hat Advanced Cluster Management For Kubernetes 2

40 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Red Hat Advanced Cluster Management For Kubernetes 2, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Advanced Cluster Management For Kubernetes 2 CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Advanced Cluster Management For Kubernetes 2 CVEs per month
MonthCVEs
2024-121
2025-010
2025-021
2025-031
2025-040
2025-050
2025-060
2025-070
2025-082
2025-091
2025-100
2025-111
2025-121
2026-011
2026-020
2026-031
2026-045
2026-050
2026-061
2026-071
2026-089
2026-093
2026-102
2026-112

Severity

How the 40 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical513%
  • High1640%
  • Medium1845%
  • Low13%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Advanced Cluster Management For Kubernetes 2.

  1. CVE-2026-84503Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce6.7
  2. CVE-2026-123037Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)6.7
  3. CVE-2026-92982Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection8.5
  4. CVE-2026-89091Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution8.8
  5. CVE-2026-93685Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)5.4
  6. CVE-2026-92615Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed6.6
  7. CVE-2026-66786Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets9.1
  8. CVE-2026-66785Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack8.7
  9. CVE-2026-70496Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork9.9
  10. CVE-2026-66780Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity6.5
  11. CVE-2026-66783Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref4.4
  12. CVE-2026-66782Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps5.8
  13. CVE-2026-66781Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication5.4
  14. CVE-2026-75924Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval8.7
  15. CVE-2026-70495Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters8.8

Product grouping is registry-driven, with AI assist and human review. How it works