{}

{}

{}

{"bugzilla": {"description": "cluster-backup-operator: cluster-backup-operator: Restore.spec.hooks passed verbatim to Velero Restore \u2014 arbitrary command execution in restored pods", "id": "2507993", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507993"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-77", "details": ["A flaw was found in cluster-backup-operator. A namespace administrator in open-cluster-management-backup can create a Restore Custom Resource (CR) with malicious hooks. These hooks allow the execution of arbitrary commands within any matching restored pod, leading to the exfiltration of ServiceAccount tokens. This bypasses normal access controls, granting the attacker unauthorized execution access to pods and their associated Service Accounts."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that only highly trusted administrators are granted `namespace-admin` privileges within the `open-cluster-management-backup` namespace. This restricts the ability to create or modify `Restore` Custom Resources with malicious hooks, thereby preventing arbitrary command execution in restored pods."}, "name": "CVE-2026-66798", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/cluster-backup-rhel9-operator", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66798\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66798"], "statement": "This vulnerability is rated Important as a namespace-admin in the `open-cluster-management-backup` namespace within Red Hat Advanced Cluster Management for Kubernetes can execute arbitrary commands in restored pods. This allows for privilege escalation and exfiltration of ServiceAccount tokens by bypassing standard `pods/exec` authorization, impacting the integrity and confidentiality of the cluster.", "threat_severity": "Important"}

{}