CVE-2026-73137

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management (affected versions not specified)

Description A flaw in the multicloud-operators-subscription component allows a tenant with HelmRelease create permissions to manipulate the secretRef.Namespace field. This enables the GetSecret() function in the HelmRelease controller to retrieve sensitive credentials from any namespace and send them to an attacker-controlled Helm repository, leading to the exfiltration of credentials from arbitrary namespace Secrets and subsequent information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.