Skip to content
fr Sign in
9.0 Critical

CVE-2026-10090 A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced…

Description

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787263584 earliest → < 1787263584 1787263584
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787263693 earliest → < 1787263693 1787263693
Red Hat Advanced Cluster Management for Kubernetes 2.14 1787170830 earliest → < 1787170830 1787170830
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787240030 earliest → < 1787240030 1787240030
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787242321 earliest → < 1787242321 1787242321
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787242108 earliest → < 1787242108 1787242108
Red Hat Advanced Cluster Management for Kubernetes 2.14.0 1787170830 earliest → < 1787170830 1787170830

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium
Track this CVE