High severity7.7NVD Advisory· Published Sep 11, 2026

CVE-2026-89060

Description

A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.

Affected products

Stolostron/Multicluster Observability Addonreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)
Red Hat/multicluster-observability-addonllm-create

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-89060nvd
bugzilla.redhat.com/show_bug.cginvd
github.com/stolostron/multicluster-observability-addon/pull/644nvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000