Live DevOps Security Brief for August 5, 2026: Pipelines, Dependencies, and Secrets

CVE-2026-10090: A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red…

NIST National Vulnerability Database | August 5, 2026 | CRITICAL | CVSS 9.9

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents…

Why it matters: CVE-2026-10090 may be embedded across servers, containers, appliances, and administration hosts. Package installation alone does not prove that the corrected code is running.

What to verify: Compare distribution package versions, identify the loaded kernel or library, plan required service restarts or reboots, and validate workload health after the change.

Operational focus: Identify whether untrusted repository content can reach privileged runners, tokens, or deployment tools.

Open the original NIST National Vulnerability Database record

CVE-2026-70490: Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

GitHub Advisory Database | August 5, 2026 | MEDIUM | CVSS 6.3 | GitHub Advisory Database open-webui

## Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that `get_verified_user` enforces on every HTTP terminal route. An account whose role is `pending`, meaning registered but not approved, or approved and later deactivated back to `pending`, can therefore open an interactive terminal…

Why it matters: GitHub Advisory Database open-webui participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Check dependency reachability and fixed versions before blocking or approving a release.

Open the original GitHub Advisory Database record

CVE-2026-10059: A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller.…

NIST National Vulnerability Database | August 5, 2026 | CRITICAL | CVSS 9.1

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to…

Why it matters: CVE-2026-10059 participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Reduce persistent credentials and keep build jobs isolated from production management paths.