Daily Digest
Urgent: The CISA‑KEV‑confirmed CVE‑2026‑9586 PostgreSQL SQL injection vulnerability in Sangoma Switchvox is actively exploited, allowing unauthenticated remote attackers to execute arbitrary SQL against the PostgreSQL backend, making it the top priority for immediate mitigation.
Summary: A remote attacker can exploit a SQL injection flaw in the Mstfakts College-Management-System’s Search Handler by manipulating the `book_name`/`book_author` arguments in the `mysqli_query` function, enabling injection of arbitrary SQL commands.
Affected Features / Interoperability: The vulnerability affects the Search Handler component and the `mysqli_query` function, potentially compromising query integrity, data confidentiality, and application security; downstream integrations such as application drivers and reporting tools may be impacted.
Source: https://github.com/Mstfakts/College-Management-System/, https://github.com/Mstfakts/College-Management-System/issues/5, https://vuldb.com/cve/CVE-2026-86213, https://vuldb.com/submit/897249, https://vuldb.com/vuln/399349
Actions:
Summary: An unauthenticated remote attacker can trigger a SQL injection in Sangoma Switchvox, allowing execution of arbitrary SQL statements against the backend PostgreSQL database, potentially leading to data manipulation or remote code execution.
Affected Features / Interoperability: The flaw impacts the Switchvox product’s PostgreSQL backend, threatening data integrity, confidentiality, and system availability; any integrations relying on the PostgreSQL database may be compromised.
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-9586
Actions:
The most urgent items in this cycle are three CRITICAL CVEs affecting Red Hat Advanced Cluster Management and Multicluster Engine for Kubernetes, with CVSS scores of 9.3, 9.1, and 9.0 respectively. These vulnerabilities enable authentication bypass, privilege escalation to cluster-admin, and unauthorized cross-cluster access—representing severe risk to any organization running these management layers. While none are currently confirmed exploited in CISA KEV, the CVSS scores and scope of compromise (full cluster takeover) warrant immediate patching priority.
Summary: A flaw in the cluster-proxy-addon component of Multicluster Engine for Kubernetes allows an unauthenticated attacker accessing the user-facing route to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster, enabling unauthorized access to internal protected services and potential information disclosure or further compromise.
Affected Features / Interoperability: The cluster-proxy-addon component responsible for multi-cluster request routing. Impacts all managed clusters connected to the affected hub, potentially exposing internal services, APIs, and credentials accessible through the proxy.
Source: https://access.redhat.com/errata/RHSA-2026:59556
Actions:
Summary: A flaw in the Multicluster Engine ClusterCurator controller allows a tenant administrator with namespace-scoped privileges to inadvertently gain the ability to mint tokens for ServiceAccounts with cluster-wide administrative authority, resulting in full cluster control through privilege escalation.
Affected Features / Interoperability: ClusterCurator controller functionality within the Multicluster Engine. Impacts IAM boundaries between tenant administrators and cluster-level permissions; could affect GitOps workflows and automated cluster configuration that rely on ClusterCurator.
Source: https://access.redhat.com/errata/RHSA-2026:59556
Actions:
Summary: A flaw in the Application Subscription controller of Red Hat ACM allows users with namespace-scoped "edit" privileges to create a Channel pointing to a malicious Helm repository and a Subscription referencing it. The controller applies the Helm chart with elevated authority without verifying the creator's subscription-admin role, enabling injection of cluster-scoped resources like ClusterRoleBindings granting cluster-admin access.
Affected Features / Interoperability: Application Subscription controller (multicluster-operators-subscription) responsible for deploying Helm charts across clusters. Impacts multi-cluster application deployment pipelines and GitOps workflows that rely on subscription-based Helm chart distribution.
Source: https://access.redhat.com/errata/RHSA-2026:60386
Actions:
Summary: A flaw in the cluster-proxy service-proxy component used in RHACM and MCE allows an authenticated hub principal to inject Impersonate-Group headers into proxied requests. Combined with the spoke ServiceAccount's unrestricted impersonation permissions, this enables privilege escalation to cluster-admin on every managed cluster.
Affected Features / Interoperability: Service-proxy component responsible for inter-cluster communication. Impacts hub-to-spoke cluster trust relationships and cross-cluster administrative access patterns.
Source: https://access.redhat.com/errata/RHSA-2026:46885
Actions:
Summary: Improper validation of Kubernetes client certificate renewal in Open Cluster Management (OCM) allows a managed cluster administrator to forge client certificates that the OCM controller will approve, enabling cross-cluster privilege escalation and potential control over other managed clusters including the hub.
Affected Features / Interoperability: OCM certificate management and managed cluster registration workflows. Impacts multi-cluster federation trust models and cluster-to-hub authentication mechanisms.
Source: https://access.redhat.com/errata/RHSA-2026:11414
Actions:
Summary: The must-gather component of Red Hat ACM collects certain wrapper Custom Resources containing embedded Secret data without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive.
Affected Features / Interoperability: must-gather diagnostic tool used for troubleshooting. Impacts any workflow where must-gather archives are shared for support or analysis purposes.
Source: https://access.redhat.com/errata/RHSA-2026:60386
Actions:
Summary: The must-gather component of Red Hat ACM dumps the cluster Proxy object in raw form, bypassing the oc inspect redaction that normally sanitizes sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive.
Affected Features / Interoperability: must-gather diagnostic tool and cluster Proxy configuration handling. Similar impact to CVE-2026-73834 for any shared must-gather archives.
Source: https://access.redhat.com/errata/RHSA-2026:60386
Actions:
Summary: Bifrost HTTP transport before version 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default). The shared-object loader treats HTTP-prefixed paths as download URLs, writes the body to a temporary .so file, and passes it to Go's plugin.Open, enabling optional remote code execution as the Bifrost process user. On dynamically linked builds, this is unauthenticated RCE; on the published static Docker image, plugin.Open fails, reducing severity to server-side request forgery.
Affected Features / Interoperability: Bifrost HTTP transport's plugin management API and custom plugin loading mechanism. Impacts deployments using Bifrost for HTTP transport with default authentication settings.
Source: https://github.com/maximhq/bifrost/releases/tag/transports/v2.0.0
Actions: