CVE-2026-66878: Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration
A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the multicloud-operators-subscription behavior so fetchchannelreferences does not honour Channel.spec.secretref.namespace for cross-namespace access; enforce that SecretRef.Namespace matches the resource’s namespace to prevent copying Secrets across namespaces.
multicloud-operators-subscription channel.spec.secretref.namespace handling (fetchchannelreferences honours channel.spec.secretref.namespace) = Do not allow cross-namespace SecretRef.Namespace (enforce same-namespace only) - Compensating control
Restrict namespace administrators so they cannot create Channel and Subscription resources that could set Channel.spec.secretref.namespace for cross-namespace Secret access (limit ability to set Channel.Spec.SecretRef.Namespace to trusted users/roles).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66878?
CVE-2026-66878 has a high severity rating of 7.7.
Who is affected by CVE-2026-66878?
CVE-2026-66878 affects privileged users, specifically namespace administrators who can create Channel and Subscription resources.
How can CVE-2026-66878 be exploited?
CVE-2026-66878 can be exploited by manipulating the Channel.Spec.SecretRef.Namespace field to facilitate cross-namespace secret exfiltration.
What should be done to mitigate CVE-2026-66878?
To mitigate CVE-2026-66878, restrict the permissions of namespace administrators and review how Channel and Subscription resources are configured.
What is the risk associated with CVE-2026-66878?
CVE-2026-66878 carries a risk score of 44, indicating significant potential for data exposure.