{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Advanced Cluster Management for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Advanced Cluster Management for Kubernetes provides the\ncapabilities to address common challenges that administrators and site\nreliability engineers face as they work across a range of public and\nprivate cloud environments. Clusters and applications are all visible and\nmanaged from a single console\u2014with security policy built in.\n\nThis advisory contains the container images for Red Hat Advanced Cluster\nManagement for Kubernetes, which add new features and enhancements, bug\nfixes, and updated container images. See the following\nRelease Notes documentation, which will be updated shortly for this\nrelease, for additional details about this release:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html-single/release_notes/index#acm-release-notes",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:60404",
        "url": "https://access.redhat.com/errata/RHSA-2026:60404"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76139",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76139"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60404.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update",
    "tracking": {
      "current_release_date": "2026-09-06T19:13:37+00:00",
      "generator": {
        "date": "2026-09-06T19:13:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:60404",
      "initial_release_date": "2026-08-26T20:29:45+00:00",
      "revision_history": [
        {
          "date": "2026-08-26T20:29:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-06T19:13:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
                  "product_id": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2.11::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Cluster Management for Kubernetes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64",
                "product": {
                  "name": "registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64",
                  "product_id": "registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/acm-operator-bundle@sha256%3Acb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/acm-operator-bundle\u0026tag=1787704547"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11",
          "product_id": "Red Hat Advanced Cluster Management for Kubernetes 2.11:registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64"
        },
        "product_reference": "registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64",
        "relates_to_product_reference": "Red Hat Advanced Cluster Management for Kubernetes 2.11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-76139",
      "cwe": {
        "id": "CWE-829",
        "name": "Inclusion of Functionality from Untrusted Control Sphere"
      },
      "discovery_date": "2026-07-27T21:12:47+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2519852"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acm-operator-bundle: acm-operator-bundle: Bundle build execs unpinned stolostron/release@master with full build credentials",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important supply chain vulnerability in the acm-operator-bundle build process. It allows for the execution of unverified external scripts with elevated privileges, including access to sensitive credentials and write access to the bundle PR, which could compromise the integrity of shipped bundles.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Advanced Cluster Management for Kubernetes 2.11:registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76139"
        },
        {
          "category": "external",
          "summary": "RHBZ#2519852",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519852"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76139",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76139"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76139",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76139"
        }
      ],
      "release_date": "2026-08-19T19:38:18.854000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T20:29:45+00:00",
          "details": "Before you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Advanced Cluster Management for Kubernetes 2.11:registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60404"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Advanced Cluster Management for Kubernetes 2.11:registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Advanced Cluster Management for Kubernetes 2.11:registry.redhat.io/rhacm2/acm-operator-bundle@sha256:cb143a7afc842904e5b55dff0fd4606a613591046f1b2770cdd45646a5ad74c4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "acm-operator-bundle: acm-operator-bundle: Bundle build execs unpinned stolostron/release@master with full build credentials"
    }
  ]
}