CVE-2026-67567
CVE-2026-67567: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityCritical9.9
Critical [CVE-2026-67567] HelmRelease chart applied with controller SA without GVK or namespace restriction
CVE-2026-67567Source published Source updated
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise. A malicious tenant capable of creating HelmRelease custom resources can exploit this to deploy arbitrary resources cluster-wide, bypassing intended namespace and GVK restrictions. This allows for significant privilege escalation within the cluster. Red Hat severity: Important — CVSS 9.9…
- Affected products in this advisory
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Management for Kubernetes 2.15
2 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- rhacm2/multicluster-operators-subscription-rhel9:1787263584
- rhacm2/multicluster-operators-subscription-rhel9:1787263693
- rhacm2/multicluster-operators-subscription-rhel9:1787170830
- rhacm2/multicluster-operators-subscription-rhel9:1787240030
8 more entries in the full advisory.
- Mitigation guidance
- To mitigate this issue, restrict the ability of untrusted tenants to create `HelmRelease` custom resources within the cluster. Implement strict Role-Based Access Control (RBAC) policies to limit which users or service accounts can create or modify `HelmRelease` objects. This will prevent unauthorized users from leveraging the controller's elevated privileges for cluster-wide resource deployment.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.