{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Elias Hasas (Brickell Technologies, LLC.) for reporting this issue.", "bugzilla": {"description": "open-cluster-management: Open-Cluster-Management: Privilege escalation and unauthorized resource modification in gRPC broker", "id": "2533540", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533540"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in open-cluster-management. An agent communicating via the gRPC broker can bypass authorization by manipulating the `ce-clustername` cloud event header attribute, which is used for authorization, independently of the actual event payload. This allows a registered managed cluster to gain unauthorized access, enabling it to move itself into other tenants' ManagedClusterSets and overwrite other clusters' ManagedCluster objects in the hub. The primary consequence is a breach of isolation between managed clusters, leading to unauthorized modification of cluster resources. This can lead to unauthorized receipt of newly delivered tenant workloads, policies, and secrets via Placement decisions. Additionally, an attacker can arbitrarily overwrite other clusters' ManagedCluster objects on the hub or perform unauthorized writes inside another cluster's dedicated hub namespace, such as forging Lease liveness heartbeats to manipulate availability status."], "name": "CVE-2026-91182", "public_date": "2026-09-23T14:43:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-91182\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91182"], "statement": "Red Hat Product Security has scored this vulnerability as Low as this feature is disabled by default in Red Hat out of the box configurations. This is also not the default path in upstream Open Cluster Management. In addition, if an attacker is able to move a cluster to a different ManageCluster object, all they can do is run a predetermined payload on the wrong cluster. There is no risk to existing payloads in terms of integrity or confidentiality.\nThe gRPC registration driver is disabled by default and represents an incomplete, work-in-progress feature path that currently lacks support for core capabilities such as OCM Addons.", "threat_severity": "Low"}

{}