Information Disclosure in multicloud-operators-subscription via Improper Cross-Namespace Secret Reference

CVE-2026-66878 describes an information disclosure vulnerability within the multicloud-operators-subscription component, often utilized in Red Hat Advanced Cluster Management for Kubernetes. The flaw resides in the subscription and channel resource management logic, specifically involving the Channel.Spec.SecretRef.Namespace field. An attacker with existing namespace administrator privileges can abuse this field to reference and copy Kubernetes Secrets from namespaces they would otherwise be unauthorized to access. By creating or updating Channel and Subscription objects with specifically crafted references, the controller performs the unauthorized copy operation, effectively exposing sensitive information such as credentials, tokens, or encryption keys. This vulnerability poses a significant risk to multi-tenant environments where strict namespace isolation is required.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive information stored in Kubernetes Secrets. In multi-tenant cloud environments, this allows an attacker with limited administrative access over a single namespace to exfiltrate secrets from other namespaces, potentially leading to full compromise of interconnected systems or downstream services relying on the leaked credentials.

Recommendation

Update the multicloud-operators-subscription component to the patched version provided by Red Hat as soon as it becomes available. In the interim, restrict the ability for users to create or modify Channel and Subscription resources via Kubernetes RBAC to only trusted cluster-level administrators. Review existing audit logs for the creation of Channel resources that reference cross-namespace Secrets.