CVE-2026-75924

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.

• CWE-269

• https://access.redhat.com/security/cve/CVE-2026-75924
• https://bugzilla.redhat.com/show_bug.cgi?id=2515720

Published

Aug 18, 2026

Last Modified

Aug 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75918phpMyFAQ before 4.1.7 stores password reset tokens in a publ…8.8
• CVE-2026-75919phpMyFAQ before 4.1.7 contains an authentication bypass vuln…5.3
• CVE-2026-7592A weakness has been identified in itsourcecode Courier Manag…7.3
• CVE-2026-75920phpMyFAQ before v4.1.6 writes content backup ZIP archives to…5.3
• CVE-2026-75921The Master Addons for Elementor – Elementor Addons, Widgets,…7.2
• CVE-2026-75922Reverse::Proxy versions before 0.04 for Perl allow HTTP requ…5.3
• CVE-2026-75925Improper neutralization of CRLF sequences in IXON VPN Client…9.6
• CVE-2026-75926Hugo 0.161.0 placed the Node asset pipelines behind the Node…8.6
• CVE-2026-75927The PublishPress Capabilities – User Role Editor, Access Per…7.2
• CVE-2026-75928The Brushfire platform's video content streaming application…5.3
• CVE-2026-7593A security vulnerability has been detected in Sunwood-ai-lab…7.3
• CVE-2026-75930The FundEngine – Donation and Crowdfunding Platform plugin f…4.3