Arbitrary Code Execution Vulnerability in Red Hat Advanced Cluster Management
CVE-2026-66793

8.8HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Advanced Cluster Management For Kubernetes 2.11; Red Hat Advanced Cluster Management For Kubernetes 2.13; Red Hat Advanced Cluster Management For Kubernetes 2.14; Red Hat Advanced Cluster Management For Kubernetes 2.15
Vendor: CVE Published:; 18 August 2026

What is CVE-2026-66793?

A vulnerability has been identified in the governance-policy-addon-controller of Red Hat Advanced Cluster Management for Kubernetes. This flaw permits a user with authorization to annotate namespaced ManagedClusterAddOn resources to manipulate the governance-policy container image, enabling the execution of an attacker-controlled image with cluster-admin privileges. As a result, this can lead to arbitrary code execution and significant privilege escalation within the managed cluster environment.