Advanced Cluster Management For Kubernetes vulnerabilities

6 known vulnerabilities in Advanced Cluster Management For Kubernetes from Red Hat. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  Red Hat Advanced Cluster Management for…: Insertion of Sensitive Information into Log File

  CVE-2026-71845Aug 11, 2026Red Hat

  A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the to

• 8.2 High severity

  multicluster engine for Kubernetes 2.1: Improper Certificate Validation

  CVE-2026-4740Apr 7, 2026Red Hat

  A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can b

• 7.5 High severity

  nodemailer: Improper Check or Handling of Exceptional Conditions

  CVE-2025-14874Dec 18, 2025Nodemailer

  A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

• 7.5 High severity

  kubernetes: Incorrect Authorization

  CVE-2022-3248Oct 5, 2023Kubernetes

  A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.

• 7.8 High severity

  RHACM: Improper Privilege Management

  CVE-2023-3027Jun 5, 2023RHACM

  The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped ac

• 7.8 High severity

  RHACM: Server-Side Request Forgery

  CVE-2022-3841Jan 13, 2023Redhat.com

  RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes (RHACM). An attacker could take advantage of this as the conso