CVE-2026-89060 Overview
CVE-2026-89060 is a cross-namespace authorization flaw in the multicluster-observability-addon component maintained by the stolostron project. A user with permission to modify a managed cluster's ManagedClusterAddOn configuration can reference ClusterLogForwarder or OpenTelemetryCollector resources located outside the permitted namespace. When those referenced resources point to Kubernetes Secrets, the add-on copies the Secrets to the attacker-controlled managed cluster. The flaw is tracked under [CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization].
Critical Impact
An authenticated user with limited add-on permissions can exfiltrate Secrets from arbitrary namespaces across managed clusters, breaking tenant isolation in Red Hat Advanced Cluster Management for Kubernetes.
Affected Products
- Red Hat Advanced Cluster Management for Kubernetes (multicluster-observability-addon)
- stolostron/multicluster-observability-addon upstream project
- Deployments referencing ClusterLogForwarder or OpenTelemetryCollector custom resources
Discovery Timeline
- 2026-09-11 - CVE-2026-89060 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-89060
Vulnerability Analysis
The multicluster-observability-addon extends Red Hat Advanced Cluster Management (RHACM) to forward logs and traces from managed clusters using the ClusterLogForwarder and OpenTelemetryCollector custom resources. Administrators configure the add-on through a ManagedClusterAddOn object bound to each managed cluster's namespace on the hub.
The add-on resolves references to ClusterLogForwarder and OpenTelemetryCollector resources without verifying that the referenced object resides in a namespace the requester is authorized to read. Any Secrets referenced by those resources are then materialized on the target managed cluster. This turns a legitimate configuration primitive into a Secret exfiltration channel across tenant boundaries.
Root Cause
The fix in GitHub Pull Request #644 restricts cross-namespace resolution so the add-on only accepts references that live within the managed cluster's authorized namespace. Before the patch, namespace scoping was enforced after object lookup, aligning with the [CWE-551] pattern of authorization checks applied out of order.
Attack Vector
An attacker requires permission to edit the ManagedClusterAddOn resource for a single managed cluster. The attacker sets the add-on configuration to reference a ClusterLogForwarder or OpenTelemetryCollector object in another namespace, for example one owned by a different tenant. The hub controller resolves the reference, reads any Secrets attached to it, and delivers those Secrets to the managed cluster the attacker controls. The attacker then reads the Secret material from the compromised cluster.
No user interaction is required, the attack traverses the network to the hub API, and the impact crosses trust boundaries between tenant namespaces on the hub.
Detection Methods for CVE-2026-89060
Indicators of Compromise
- Unexpected ManagedClusterAddOn updates that reference ClusterLogForwarder or OpenTelemetryCollector resources outside the managed cluster's own namespace.
- Secrets appearing on managed clusters that do not correspond to workloads scheduled on those clusters.
- Audit log entries showing hub controllers reading Secrets in namespaces unrelated to the requesting user's tenant.
Detection Strategies
- Query Kubernetes audit logs for patch or update verbs on managedclusteraddons where spec.configs[] references a namespace foreign to the managed cluster.
- Correlate Secret get events performed by the multicluster-observability-addon service account with the namespaces of legitimate tenants.
- Alert on the creation of Secrets on spoke clusters whose names match Secrets from other tenants' hub namespaces.
Monitoring Recommendations
- Forward hub cluster audit logs to a centralized analytics pipeline and retain them for post-incident review.
- Baseline the normal set of ClusterLogForwarder and OpenTelemetryCollector references per managed cluster and alert on deviations.
- Monitor RHACM controller service accounts for privilege usage that spans tenant namespaces.
How to Mitigate CVE-2026-89060
Immediate Actions Required
- Apply the updates shipped in Red Hat Security Advisories RHSA-2026:67539, RHSA-2026:67540, RHSA-2026:67541, RHSA-2026:67542, and RHSA-2026:67543.
- Audit existing ManagedClusterAddOn resources for cross-namespace references to ClusterLogForwarder or OpenTelemetryCollector objects.
- Rotate any Secrets that may have been copied to unauthorized managed clusters.
Patch Information
Red Hat has released patched builds of the multicluster-observability-addon under the advisories listed above. The upstream code fix is available in GitHub Pull Request #644. Vendor tracking details are documented in the Red Hat CVE page for CVE-2026-89060 and Red Hat Bug Report #2531596.
Workarounds
- Restrict write access to ManagedClusterAddOn resources using RBAC so only trusted cluster administrators can modify add-on configurations.
- Remove or relocate sensitive Secrets from namespaces referenced by ClusterLogForwarder and OpenTelemetryCollector resources until patches are applied.
- Use Kubernetes admission controllers, such as OPA Gatekeeper or Kyverno, to reject ManagedClusterAddOn configurations that reference resources outside the managed cluster's own namespace.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
