CVE-2026-66793CWE-20

CVE-2026-66793

High · published August 18, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00810 · 56.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-18T19:17Z
References (8)
https://bugzilla.redhat.com/show_bug.cgi?id=2507538 · [email protected]https://access.redhat.com/errata/RHSA-2026:60386 · [email protected]https://access.redhat.com/errata/RHSA-2026:60387 · [email protected]https://access.redhat.com/errata/RHSA-2026:60388 · [email protected]https://access.redhat.com/errata/RHSA-2026:60389 · [email protected]https://access.redhat.com/errata/RHSA-2026:60390 · [email protected]https://access.redhat.com/errata/RHSA-2026:60391 · [email protected]https://access.redhat.com/security/cve/CVE-2026-66793 · [email protected]
EPSS history
Timeline
  • 18 AUG 15:02Z
    Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke
    cvelistv5