{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91182.json"
      }
    ],
    "title": "open-cluster-management: Open-Cluster-Management: Privilege escalation and unauthorized resource modification in gRPC broker",
    "tracking": {
      "current_release_date": "2026-09-23T15:01:23+00:00",
      "generator": {
        "date": "2026-09-23T15:01:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "CVE-2026-91182",
      "initial_release_date": "2026-09-23T14:43:14.365000+00:00",
      "revision_history": [
        {
          "date": "2026-09-23T14:43:14.365000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-23T14:48:38+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-09-23T15:01:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "product": {
          "name": "All currently supported Red Hat products",
          "product_id": "red_hat_products",
          "product_identification_helper": {
            "cpe": "cpe:/a:redhat"
          }
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Elias Hasas"
          ],
          "organization": "Brickell Technologies, LLC."
        }
      ],
      "cve": "CVE-2026-91182",
      "discovery_date": "2026-09-14T22:41:27.571000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_products"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in open-cluster-management. An agent communicating via the gRPC broker can bypass authorization by manipulating the `ce-clustername` cloud event header attribute, which is used for authorization, independently of the actual event payload. This allows a registered managed cluster to gain unauthorized access, enabling it to move itself into other tenants' ManagedClusterSets and overwrite other clusters' ManagedCluster objects in the hub. The primary consequence is a breach of isolation between managed clusters, leading to unauthorized modification of cluster resources. This can lead to unauthorized receipt of newly delivered tenant workloads, policies, and secrets via Placement decisions. Additionally, an attacker can arbitrarily overwrite other clusters' ManagedCluster objects on the hub or perform unauthorized writes inside another cluster's dedicated hub namespace, such as forging Lease liveness heartbeats to manipulate availability status.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has scored this vulnerability as Low as this feature is disabled by default in Red Hat out of the box configurations. This is also not the default path in upstream Open Cluster Management. In addition, if an attacker is able to move a cluster to a different ManageCluster object, all they can do is run a predetermined payload on the wrong cluster. There is no risk to existing payloads in terms of integrity or confidentiality.\n\nThe gRPC registration driver is disabled by default and represents an incomplete, work-in-progress feature path that currently lacks support for core capabilities such as OCM Addons.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_products"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91182"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91182",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91182"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91182",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91182"
        }
      ],
      "release_date": "2026-09-23T14:43:14.365000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "red_hat_products"
          ]
        }
      ],
      "title": "open-cluster-management: Open-Cluster-Management: Privilege escalation and unauthorized resource modification in gRPC broker"
    }
  ]
}