Product by Red Hat
Red Hat Advanced Cluster Management For Kubernetes 2
32 known vulnerabilities in Red Hat Advanced Cluster Management For Kubernetes 2 (Red Hat), 0 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-66786 | Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets | 9.1 | |
| Critical | CVE-2026-16242 | Red Hat multicluster engine for Kubernetes 2.1: Missing Authentication for Critical Function | 9.4 | |
| Critical | CVE-2026-66792 | Red Hat Multicluster Global Hub 1.4.9: Incorrect Authorization | 9.9 | |
| Critical | CVE-2026-70496 | Red Hat Advanced Cluster Management for Kubernetes: Execution with Unnecessary Privileges | 9.9 | |
| High | CVE-2026-89091 | Red Hat Migration Toolkit for Applications 8: Link Following | 8.8 | |
| High | CVE-2026-92982 | Red Hat Ansible Automation Platform 2.6: Improper Neutralization of Special Elements Used in a Template Engine | 8.5 | |
| High | CVE-2024-3727 | Containers/image: digest type does not guarantee valid type | 8.3 | |
| Critical | CVE-2025-10894 | Nx: nx/devkit: malicious versions of nx and plugins published to npm | 9.6 | |
| Medium | CVE-2026-66780 | Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity | 6.5 | |
| High | CVE-2024-1139 | Cluster-monitoring-operator: credentials leak | 7.7 | |
| High | CVE-2026-75924 | Red Hat Multicluster Engine for Kubernetes: Improper Privilege Management | 8.7 | |
| Medium | CVE-2024-11831 | Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript | 5.4 | |
| High | CVE-2025-14874 | Nodemailer: nodemailer: denial of service via crafted email address header | 7.5 | |
| High | CVE-2026-66785 | Red Hat Advanced Cluster Management for Kubernetes 2.16: Insufficient Verification of Data Authenticity | 8.7 | |
| High | CVE-2026-70495 | Red Hat Advanced Cluster Management for Kubernetes: Improper Privilege Management | 8.8 | |
| High | CVE-2026-11332 | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | 7.8 | |
| High | CVE-2025-13033 | Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict | 7.5 | |
| Medium | CVE-2026-93685 | Red Hat Advanced Cluster Management for Kubernetes 2: Exposure of Sensitive Information to an Unauthorized Actor | 5.4 | |
| High | CVE-2025-2241 | Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm | 8.2 | |
| Medium | CVE-2026-92615 | Red Hat Advanced Cluster Management for Kubernetes 2: Improper Resource Locking | 6.6 | |
| Medium | CVE-2026-66782 | Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps | 5.8 | |
| Medium | CVE-2026-66781 | Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication | 5.4 | |
| High | CVE-2024-9779 | Open-cluster-management-io: Incorrect Privilege Assignment | 7.5 | |
| Medium | CVE-2024-0874 | Coredns: cd bit response is cached and served later | 5.3 | |
| High | CVE-2023-3089 | Ocp & fips mode | 7.0 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,