{
  "threat_severity" : "Important",
  "public_date" : "2026-08-11T00:00:00Z",
  "bugzilla" : {
    "description" : "cluster-backup-operator: cluster-backup-operator: Velero Restore includes cluster-scoped RBAC resources with no exclusion — tampered backup yields hub cluster-admin",
    "id" : "2507992",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2507992"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-862",
  "details" : [ "Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.\nThe addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.\nThis issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "A flaw was found in the cluster-backup-operator. An attacker with write access to the backup storage location or the ability to create a Velero Backup object can inject malicious Role-Based Access Control (RBAC) resources into a backup. When this tampered backup is restored, the operator processes the malicious content, leading to a privilege escalation from backup-namespace-admin to hub cluster-admin. This allows the attacker to gain administrative control over the entire cluster." ],
  "statement" : "Important: The cluster-backup-operator in Red Hat Advanced Cluster Management for Kubernetes is vulnerable to privilege escalation. An attacker with write access to the backup storage location or the ability to create Velero Backup objects can inject malicious RBAC configurations into a backup. During a restore operation, the operator will process this tampered content, granting the attacker hub cluster-admin privileges. This is considered Important due to the complete compromise of the hub cluster's administrative control.",
  "affected_release" : [ {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.11",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60387",
    "cpe" : "cpe:/a:redhat:acm:2.11::el9",
    "package" : "rhacm2/cluster-backup-rhel9-operator:1787684668"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.13",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60390",
    "cpe" : "cpe:/a:redhat:acm:2.13::el9",
    "package" : "rhacm2/cluster-backup-rhel9-operator:1787259060"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.14",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60388",
    "cpe" : "cpe:/a:redhat:acm:2.14::el9",
    "package" : "rhacm2/cluster-backup-rhel9-operator:1787183178"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.15",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60389",
    "cpe" : "cpe:/a:redhat:acm:2.15::el9",
    "package" : "rhacm2/cluster-backup-rhel9-operator:1787238500"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.16",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60391",
    "cpe" : "cpe:/a:redhat:acm:2.16::el9",
    "package" : "rhacm2/cluster-backup-rhel9-operator:1787183176"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.17",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60386",
    "cpe" : "cpe:/a:redhat:acm:2.17::el9",
    "package" : "rhacm2/cluster-backup-rhel9-operator:1787227576"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-66797\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66797" ],
  "name" : "CVE-2026-66797",
  "mitigation" : {
    "value" : "Restrict access to the backup storage location (e.g., S3 bucket) to authorized personnel only. Implement strict Role-Based Access Control (RBAC) to limit which users or service accounts can create Velero Backup objects within the open-cluster-management-backup namespace. This prevents an attacker from injecting malicious ClusterRoleBindings into backups or referencing untrusted backup objects. Ensure that only trusted and verified backups are used for restore operations.",
    "lang" : "en:us"
  },
  "csaw" : false
}