{}

{}

{}

{"bugzilla": {"description": "cluster-backup-operator: cluster-backup-operator: Velero Restore includes cluster-scoped RBAC resources with no exclusion \u2014 tampered backup yields hub cluster-admin", "id": "2507992", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507992"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-862", "details": ["A flaw was found in the cluster-backup-operator. An attacker with write access to the backup storage location or the ability to create a Velero Backup object can inject malicious Role-Based Access Control (RBAC) resources into a backup. When this tampered backup is restored, the operator processes the malicious content, leading to a privilege escalation from backup-namespace-admin to hub cluster-admin. This allows the attacker to gain administrative control over the entire cluster."], "mitigation": {"lang": "en:us", "value": "Restrict access to the backup storage location (e.g., S3 bucket) to authorized personnel only. Implement strict Role-Based Access Control (RBAC) to limit which users or service accounts can create Velero Backup objects within the open-cluster-management-backup namespace. This prevents an attacker from injecting malicious ClusterRoleBindings into backups or referencing untrusted backup objects. Ensure that only trusted and verified backups are used for restore operations."}, "name": "CVE-2026-66797", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/cluster-backup-rhel9-operator", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66797\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66797"], "statement": "Important: The cluster-backup-operator in Red Hat Advanced Cluster Management for Kubernetes is vulnerable to privilege escalation. An attacker with write access to the backup storage location or the ability to create Velero Backup objects can inject malicious RBAC configurations into a backup. During a restore operation, the operator will process this tampered content, granting the attacker hub cluster-admin privileges. This is considered Important due to the complete compromise of the hub cluster's administrative control.", "threat_severity": "Important"}

{}