CVE-2026-18874CWE-94code-injection

CVE-2026-18874

Medium · published August 19, 2026

CVSS v3.1
6.2
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-19T22:16Z
References (8)
https://access.redhat.com/errata/RHSA-2026:60386 · [email protected]https://access.redhat.com/errata/RHSA-2026:60387 · [email protected]https://access.redhat.com/errata/RHSA-2026:60388 · [email protected]https://access.redhat.com/errata/RHSA-2026:60389 · [email protected]https://access.redhat.com/errata/RHSA-2026:60390 · [email protected]https://access.redhat.com/errata/RHSA-2026:60391 · [email protected]https://access.redhat.com/security/cve/CVE-2026-18874 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2511115 · [email protected]
EPSS history
Timeline
  • 19 AUG 17:52Z
    Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription
    cvelistv5