Red hat advanced cluster management for kubernetes 2

This hub aggregates every CVE we track for Red hat advanced cluster management for kubernetes 2, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat advanced cluster management for kubernetes 2.

• CVE-2026-93685Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)5.4Sep 18, 2026
• CVE-2026-92615Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed6.6Sep 16, 2026
• CVE-2026-66786Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets9.1Sep 2, 2026
• CVE-2026-66785Submariner: ipsec psk secrets file created with default world-readable permissions2.5Aug 20, 2026
• CVE-2026-70496Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork9.9Aug 19, 2026
• CVE-2026-66780Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity6.5Aug 18, 2026
• CVE-2026-66783Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref4.4Aug 18, 2026
• CVE-2026-66782Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps5.8Aug 18, 2026
• CVE-2026-66781Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication5.4Aug 18, 2026
• CVE-2026-75924Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval8.7Aug 18, 2026
• CVE-2026-70495Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters8.8Aug 17, 2026
• CVE-2026-66792Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters9.9Aug 17, 2026
• CVE-2026-16242Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates9.4Jul 20, 2026
• CVE-2026-11332Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution7.8Jun 5, 2026
• CVE-2026-33812Excessive memory allocation when decoding malicious SFNT in golang.org/x/image6.1Apr 21, 2026