Remote Access Flaw in Multicluster Observability Addon by Red Hat
CVE-2026-93685

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Advanced Cluster Management For Kubernetes 2
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93685?

A misconfiguration in the multicluster-observability-addon allows unauthorized remote access to a debug endpoint. This oversight permits attackers to obtain sensitive operational details, including goroutine, heap, and command-line information, following the establishment of a basic encrypted connection. This vulnerability does not facilitate direct remote code execution, but it poses significant risks in terms of data exposure and system integrity.

References

https://access.redhat.com/security/cve/CVE-2026-93685
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2518377
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.