RHACM GitOpsCluster: tenant can redirect spoke cluster bearer tokens into a namespace they control

Impact

An authenticated tenant can manipulate the GitOpsCluster controller so that bearer tokens for managed spoke clusters are written into a namespace the tenant owns. Those tokens are the hub's credentials for driving the spokes, so recovering one means acting against a managed cluster directly and stepping around the ArgoCD AppProject boundaries that were supposed to limit which clusters a tenant can deploy to. In a GPU fleet managed by ACM, a spoke token is effectively a key to whatever the ACM agent can do on that cluster's nodes and workloads. The tokens are long-lived, so the exposure persists until they are rotated - patching alone does not undo a leak that already happened.

Who can reach it

Any authenticated ACM hub user (tenant) able to influence GitOpsCluster resources and read secrets in a namespace they control. Network-reachable via the hub API; no node access needed.

What to do

Apply the Red Hat errata for your ACM stream (RHSA-2026:60386 through 60390, covering 2.11 and 2.13 through 2.17). The fix is a hub-side operator update that rolls the multicloud-integrations controller pods - no spoke or GPU node reboot. Because this is a credential-disclosure flaw, also rotate spoke cluster bearer tokens and audit tenant namespaces for copied secrets after patching.

References

Related entries

• Rancher: SAML assertion replay: the ACS handler does not enforce one-time use, so a captured assertion logsCVE-2026-44946 · RancherCritical
• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical
• containerd: CRI plugin propagates unvalidated image LABEL values into container configCVE-2026-53488 · containerdCritical
• Kata Containers: Kata with Cloud Hypervisor allows a user to break the VM isolation boundaryCVE-2026-24834 · Kata ContainersCritical
• Multicluster Engine cluster-proxy-addon: unauthenticated path manipulation proxies to any managed-cluster serviceCVE-2026-66794 · Red Hat Multicluster Engine for Kubernetes (cluster-proxy-addon)Critical
• Kata Containers: runtime-rs standalone virtio-fs path is vulnerable to a guest-to-host escapeCVE-2026-47243 · Kata ContainersCritical