CVE-2026-66878

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription (affected versions not specified)

Description A flaw exists where a privileged user, such as a namespace administrator with permissions to create Channel and Subscription resources, can perform cross-namespace secret exfiltration. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can force the system to copy sensitive Secret contents from other namespaces into their own, resulting in information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.