Red Hat has disclosed a critical security vulnerability in its Advanced Cluster Management solution (RHACM). The flaw is tracked as EUVD-2026-57058 and CVE-2026-70398 and carries a CVSS score of 9.6. It lets authenticated users derive sensitive cluster tokens and bypass security policies. No patch is available yet.
Manipulating the GitOpsCluster controller
The flaw sits in the "multicloud-integrations" component and affects the management of Kubernetes clusters in hybrid and multi-cloud environments. Companies use RHACM to centrally manage and orchestrate multiple Kubernetes clusters. An authenticated user, meaning a tenant, can manipulate the GitOpsCluster controller. That lets them intercept sensitive bearer tokens from managed spoke clusters and redirect them into a namespace they control. These tokens grant access to critical cluster functions and configurations. It's a network-reachable scenario with low complexity but high impact on confidentiality and integrity.
The impact reaches beyond the affected RHACM installation. By deriving cluster tokens, attackers can also bypass ArgoCD AppProject security policies. ArgoCD is a widely used GitOps tool for managing Kubernetes deployments. An attacker could not only access cluster data but also make unauthorized changes to cluster configurations, opening the door to lateral movement across the entire infrastructure.
No patches, only interim measures
Affected is Red Hat Advanced Cluster Management for Kubernetes 2.x, specifically the rhacm2/multicloud-integrations-rhel9 component. Red Hat hasn't published specific patched versions yet. According to the security advisory, all previous versions of the affected package within the relevant minor update stream should be considered vulnerable. The vendor states that available mitigation options either don't meet its own criteria for usability, deployability, and stability, or simply don't exist.
If you use RHACM, you should limit access to the GitOpsCluster controller component to users with the minimum required permissions as a precaution until a patch becomes available. A full review of cluster token management and ArgoCD configurations is also recommended, to catch unauthorized token derivations or policy bypasses early.