Red HatCVE-2026-67567
A flaw was found in the multicloud-operators-subscription component
Critical9.9CVE-2026-67567 · Published Aug 20, 2026 · updated Aug 28, 2026
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-441
- www.cve.org/CVERecord?id=CVE-2026-67567
- nvd.nist.gov/vuln/detail/CVE-2026-67567
- access.redhat.com/errata/RHSA-2026:60386
- access.redhat.com/errata/RHSA-2026:60387
- access.redhat.com/errata/RHSA-2026:60388
- access.redhat.com/errata/RHSA-2026:60389
- access.redhat.com/errata/RHSA-2026:60390
- access.redhat.com/errata/RHSA-2026:60391
- access.redhat.com/security/cve/CVE-2026-67567
- bugzilla.redhat.com/show_bug.cgi?id=2514224
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 20 | Red Hat multicloud-operators-subscription: information disclosure | High7.7 | No fix yet |
| Aug 20 | Red Hat Advanced Cluster Management for Kubernetes 2: information disclosure | Low2.5 | No fix yet |
| Aug 20 | Red Hat lighthouse: information disclosure | Medium5.4 | No fix yet |
| Aug 20 | Red Hat Lighthouse. A remote attacker: privilege escalation | Low3.7 | No fix yet |
| Aug 20 | A flaw was found in Kata Containers | High8.1 | No fix yet |
| Aug 20 | A flaw was found in WildFly Elytron | High7.4 | No fix yet |