RHACM GitOpsCluster: tenant can redirect spoke cluster bearer tokens into a namespace they control

Impact

An authenticated tenant can manipulate the GitOpsCluster controller so that bearer tokens for managed spoke clusters are written into a namespace the tenant owns. Those tokens are the hub's credentials for driving the spokes, so recovering one means acting against a managed cluster directly and stepping around the ArgoCD AppProject boundaries that were supposed to limit which clusters a tenant can deploy to. In a GPU fleet managed by ACM, a spoke token is effectively a key to whatever the ACM agent can do on that cluster's nodes and workloads. The tokens are long-lived, so the exposure persists until they are rotated - patching alone does not undo a leak that already happened.

Who can reach it

Any authenticated ACM hub user (tenant) able to influence GitOpsCluster resources and read secrets in a namespace they control. Network-reachable via the hub API; no node access needed.

What to do

Apply the Red Hat errata for your ACM stream (RHSA-2026:60386 through 60390, covering 2.11 and 2.13 through 2.17). The fix is a hub-side operator update that rolls the multicloud-integrations controller pods - no spoke or GPU node reboot. Because this is a credential-disclosure flaw, also rotate spoke cluster bearer tokens and audit tenant namespaces for copied secrets after patching.

References

Related entries

• Dokploy: unquoted dockerImage field gives command execution on the build hostCVE-2026-72877 · Dokploy Docker build path (dockerImage field in buildRemoteDocker)Critical
• OpenChoreo cluster-gateway: unauthenticated management API exposes data-plane Kubernetes API and pod execCVE-2026-73843 · OpenChoreo cluster-gateway (agent listener management API)Critical
• Rancher: SAML assertion replay: the ACS handler does not enforce one-time use, so a captured assertion logsCVE-2026-44946 · RancherCritical
• Coolify: low-privileged member injects Docker Compose directives and gets root on the hostCVE-2025-59156 · Coolify (application deployment workflow, Docker Compose directives)Critical
• Kyverno: percent-encoded traversal in Policy apiCall urlPath escapes the namespace clamp to cluster adminCVE-2026-100706 · Kyverno admission controller (Policy apiCall urlPath namespace clamp)Critical
• Docker Hub: converting an account reassigned a PAT to another user without rotating the secretCVE-2026-105445 · Docker Hub (account-to-organization conversion, personal access tokens)Critical