High [CVE-2026-66799] Restore.spec.namespaceMapping pass-through enables cross-namespace Secret/ConfigMap placement

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally. A flaw was found in the cluster-backup-operator.

A privileged user with administrative access to a specific namespace could exploit a vulnerability in the backup restoration process. This flaw allows them to redirect sensitive information, such as cloud provider credentials and access tokens, from backup operations into other namespaces, including those they control.

This could lead to unauthorized access to critical system resources and the disclosure of confidential data. This is an Important vulnerability in Red Hat Advanced Cluster Management for Kubernetes.

This allows for a cross-namespace write of credential material, potentially leading to unauthorized access to cloud provider credentials, pull secrets, and ManagedServiceAccount tokens. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

Weakness: CWE-863. Red Hat fixing advisory: RHSA-2026:60390, RHSA-2026:60388, RHSA-2026:60389, RHSA-2026:57191, RHSA-2026:60386.

Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; Red Hat Advanced Cluster Management for Kubernetes 2.16; and 1 more.