CVE-2026-89060

HighCVSS 7.7

Published: 11/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster's ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Risk Assessment

An attacker could exfiltrate credentials and other sensitive data stored in Kubernetes Secrets, potentially leading to further privilege escalation within the cluster.

Recommendation

Restrict permissions to modify ManagedClusterAddOn configuration and update multicluster-observability-addon to a version containing the cross-namespace authorization fix.

Other vulnerabilities in multicluster-observability-addon

CVE-2026-93685Medium
A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

Original NVD description (English source)

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS