CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-70398 — A flaw was found in multicloud-integrations, a component of Red Hat Advanced Clu...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to

Analysis

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects. CVSS Score: 9.6. Published: 2026-08-12T02:16:38.060.

Indicators of Compromise (1)

CVE (1)
CVE-2026-70398
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 12, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

The Hacker News
LOWVulnerabilityNEW

Cyber Incident Disrupts Student Services at UT San Antonio

UT San Antonio has taken IT systems offline following a cyber incident, disrupting student registration and tuition payments days before term is due to resume

Infosecurity Magazine
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-75627 — Bastillion fails to properly validate request URI paths in its controller dispat...

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

CVE-2026-75627
NIST NVD