Bottom line: A vulnerability in Red Hat Advanced Cluster Management enables authenticated attackers to execute code and carry out DoS attacks on central cluster management infrastructure.
A vulnerability exists in Red Hat Advanced Cluster Management and Multicluster engine for Kubernetes that allows authenticated attackers to execute arbitrary code or crash the service. The German Federal Office for Information Security (BSI) warns of high risk.
Red Hat Advanced Cluster Management (ACM) and the Multicluster engine for Kubernetes are affected. The vulnerability allows an authenticated attacker with sufficient privileges to execute arbitrary code in the cluster or cause a denial-of-service condition. The exact cause and CVE-ID are documented by the BSI under the identifier WID-SEC-2026-1367.
For CISOs, this is critical since cluster management systems are central components in modern container infrastructures. A compromised ACM or Multicluster engine potentially endangers all managed Kubernetes clusters and their workloads and data. The BSI rates the vulnerability as “high”.
Affected organizations should immediately verify whether Red Hat Advanced Cluster Management or the Multicluster engine is deployed in their environment and promptly implement a patch strategy. Red Hat provides Security Advisor and patches via standard update channels. Additionally, it is recommended to review access control policies on these systems to minimize the risk from authenticated attackers.
Source: wid.cert-bund.de · Published June 5, 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrasing and classification via Lumi News Pipeline v1.6.2.