Security readout for executives and security teams
Plain-English summary
An authenticated RHACM tenant can redirect spoke-cluster bearer tokens into a namespace they control. Stolen tokens could expose sensitive cluster information and bypass ArgoCD AppProject security boundaries. The flaw is critical because exploitation is remote, low-complexity, requires only limited privileges, and needs no user interaction.
Executive priority
Treat as an urgent privileged-access boundary failure. Prioritize internet-connected or multi-tenant RHACM management environments, validate exposure immediately, and schedule the applicable Red Hat updates through emergency change procedures. Investigate suspicious namespace redirection and rotate affected credentials rather than relying on patching alone.
Technical view
CVE-2026-70398 affects the RHACM multicloud-integrations component. A tenant can manipulate GitOpsCluster spec.argoServer.argoNamespace so the controller writes sensitive spoke bearer tokens into an attacker-chosen namespace. CVSS 3.1 is 9.6, with high confidentiality and integrity impact across a changed security scope, but no stated availability impact.
Likely exposure
Potential exposure exists where listed RHACM 2.11 or 2.13 through 2.17 multicloud-integrations builds are deployed and authenticated tenants can manipulate GitOpsCluster resources. The bundle does not list RHACM 2.12 or establish its status. Confirm installed package builds against the matching Red Hat errata.
Exploitation context
Exploitation requires an authenticated, low-privilege tenant able to influence the GitOpsCluster controller; no victim interaction is required. The supplied KEV signal is false, and no cited source in the bundle confirms active exploitation. Public exploit availability is not established by the supplied evidence.
Researcher notes
The source bundle identifies CWE-441 and specific affected build identifiers but does not provide fixed-build mappings, configuration prerequisites beyond authenticated tenant access, or evidence of exploitation. Validation should focus on authorization paths to GitOpsCluster modification, destination-namespace control, historical token writes, and installed-build correlation with the six Red Hat advisories.
Mitigation direction
- Identify RHACM clusters running the listed multicloud-integrations package builds.
- Apply the applicable Red Hat security erratum for each affected RHACM release.
- Restrict tenant permissions to create or modify GitOpsCluster resources until updates are verified.
- Review namespace authorization and isolate sensitive controller-managed secrets from tenant-controlled namespaces.
- Rotate potentially exposed spoke-cluster bearer tokens after investigating suspected redirection.
Validation and detection
- Inventory RHACM versions and compare installed multicloud-integrations builds with the affected identifiers.
- Verify the applicable Red Hat erratum is installed on every RHACM management cluster.
- Audit GitOpsCluster resources for unexpected spec.argoServer.argoNamespace destinations.
- Review audit logs and namespace events for unusual controller writes into tenant-controlled namespaces.
- Confirm rotated tokens invalidate any credentials potentially disclosed before remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-441: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-70398 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N3.15.8redhatVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:60386CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60387CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60388CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60389CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60390CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60391CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-70398CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2514228CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unintended Proxy or Intermediary ('Confused Deputy')
Unintended Proxy or Intermediary ('Confused Deputy') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.