« Back to list

CVE-2026-73137

Status: Awaiting AnalysisHigh (7.7)—

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

AV:N + PR:L + acceso a servicios remotos (HelmRelease controller). Impacto: extracción de secrets de namespaces arbitrarios (T1005: datos en memoria/almacenamiento; T1552: credenciales en configuración).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account ManagementUpdate SoftwareActive Directory ConfigurationVulnerability ScanningUser TrainingThreat Intelligence Program

Affected technologies (2)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Redhat — Advanced Cluster ManagementAIRedhat — Multicloud Operators SubscriptionAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-73137",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73137",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-21T15:41:12.138460Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.11::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787263584",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.13::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787263693",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787170830",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787240030",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787242321",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787242108",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-20T21:17:09.270",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60386",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60387",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60388",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60389",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60390",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60391",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-73137",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514223",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure."
    }
  ],
  "lastModified": "2026-08-28T21:17:10.720",
  "sourceIdentifier": "secalert@redhat.com"
}