CVE-2026-70398

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management (affected versions not specified)

Description A flaw in the multicloud-integrations component allows an authenticated tenant to manipulate the GitOpsCluster controller. An attacker can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace under their control by exploiting the gitopscluster.spec.argoserver.argonamespace variable. This unauthorized access to tokens can result in the disclosure of critical information and the bypass of security policies within ArgoCD AppProjects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.