Executive brief
A flaw in Red Hat Advanced Cluster Management's multicloud-operators-subscription component allows tenants with permission to create HelmRelease resources to bypass security controls and deploy arbitrary applications across the entire Kubernetes cluster using elevated system privileges. An attacker exploiting this vulnerability could gain cluster-wide access, install malicious workloads, and compromise all applications and data running on the platform.
Technical details
The vulnerability exists in the HelmRelease controller, which processes Helm chart templates using its own elevated ServiceAccount privileges without properly validating or restricting the resources a tenant can deploy. The root cause is insufficient authorization controls when rendering Helm charts; a tenant with HelmRelease creation rights can craft malicious templates that the controller processes with cluster-admin-equivalent permissions. The attack requires network access to the Kubernetes API server and the ability to create custom resources, but no additional authentication bypass is needed—the attacker leverages their existing tenancy privileges. An attacker can deploy arbitrary resources (Deployments, DaemonSets, ClusterRoles, etc.) cluster-wide, leading to complete cluster compromise. A patch is available in Red Hat Advanced Cluster Management for Kubernetes v2.17.1.
Affected products
- Red Hat Advanced Cluster Management for Kubernetes 2.17.0
Timeline
- 2026-08-20: disclosed: CVE-2026-67567 disclosed
- 2026-08-26: advisory: Red Hat Security Advisory RHSA-2026:60386 issued
- 2026-08-26: patched: Fix available in Red Hat Advanced Cluster Management for Kubernetes v2.17.1