A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.

A critical vulnerability was identified in the multicloud-operators-subscription component affecting Kubernetes/OpenShift environments. Tenants with the ability to create HelmRelease custom resources can bypass existing security controls. The HelmRelease controller processes Helm chart templates using elevated ServiceAccount privileges without proper validation. This allows malicious tenants to deploy arbitrary resources across the entire cluster. The flaw represents a significant privilege escalation and tenant isolation bypass. It can lead to full cluster compromise by an otherwise limited tenant. The vulnerability is tracked as CVE-2026-67567 and has been reported by Red Hat. A corresponding Bugzilla report (2514224) has been filed for remediation tracking.