Cross-namespace secret exfiltration via secretRef.Namespace

Information disclosure in RHACM allows remote authenticated users to read cross-namespace Secrets through HelmRelease creation. In Red Hat Advanced Cluster Management's multicloud-operators-subscription component, the HelmRelease controller's GetSecret() function trusts the tenant-controlled secretRef.Namespace field and uses the controller's privileged client to fetch a Secret from any namespace, then sends those credentials as HTTP Basic Auth to the referenced Helm repository. Exploitation requires permission to create HelmRelease resources, and the published record bounds the impact to unauthorized disclosure of Secret data from other namespaces.