CVE-2026-89060

Name of the Vulnerable Software and Affected Versions multicluster-observability-addon (affected versions not specified)

Description A cross-namespace authorization flaw exists in the multicluster-observability-addon. A user with permissions to modify the ManagedClusterAddOn configuration of a managed cluster can reference ClusterLogForwarder or OpenTelemetryCollector resources located outside the permitted namespace. If these referenced resources contain Secrets, the add-on may copy those Secrets to a managed cluster controlled by the attacker, leading to unauthorized Secret exfiltration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.