Vulnerability Description
A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:60386
- https://access.redhat.com/errata/RHSA-2026:60387
- https://access.redhat.com/errata/RHSA-2026:60388
- https://access.redhat.com/errata/RHSA-2026:60389
- https://access.redhat.com/errata/RHSA-2026:60390
- https://access.redhat.com/errata/RHSA-2026:60391
- https://access.redhat.com/security/cve/CVE-2026-66878
- https://bugzilla.redhat.com/show_bug.cgi?id=2514226
FAQ
What is CVE-2026-66878?
CVE-2026-66878 is a vulnerability with a CVSS score of 7.7 (HIGH). A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability....
How severe is CVE-2026-66878?
CVE-2026-66878 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-66878?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.