CVE-2026-67567

CRITICAL9.9

Published 2026-08-20 · Source secalert@redhat.com

Description

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-441

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-72843
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".
2026-08-20 · score 9.8
CVE-2026-69851
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
2026-08-20 · score 9.9
CVE-2026-69836
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
2026-08-20 · score 10.0
CVE-2026-69555
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
2026-08-20 · score 10.0
CVE-2026-69400
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
2026-08-20 · score 9.6