CVE-2026-66793
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
In the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes, a user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.
Risk Assessment
An attacker can gain full control over the managed Kubernetes cluster, leading to compromise of integrity and confidentiality of the entire environment.
Recommendation
Restrict permissions to annotate the ManagedClusterAddOn resource and update the component to a patched version.
Original NVD description (English source)
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.