Full Report
Bulletin de sécurité Red Hat (AV26-803)
Analysis Summary
# Vulnerability: Red Hat Advanced Cluster Management Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-10090
- **CVSS Score:** 8.8 (High) - *Estimated based on typical "Cluster-Admin" escalation profiles.*
- **CWE:** CWE-269 (Improper Privilege Management)
## Affected Systems
- **Products:** Red Hat Advanced Cluster Management for Kubernetes (RHACM)
- **Versions:** RHACM 2.x
- **Configurations:** Systems utilizing the `multicluster-operators-subscription` component.
## Vulnerability Description
A privilege escalation vulnerability exists in the `multicluster-operators-subscription` component of Red Hat Advanced Cluster Management. The flaw allows a user with permissions to edit a specific namespace to deploy a cluster-scoped `ClusterRoleBinding` via an Application Subscription. By manipulating this subscription, an attacker can elevate their privileges to `cluster-admin`, effectively gaining full control over the entire Kubernetes cluster.
## Exploitation
- **Status:** Not reported as exploited in the wild at the time of this bulletin.
- **Complexity:** Low
- **Attack Vector:** Network (Authenticated)
- **Privileges Required:** Low (Namespace edit permissions)
## Impact
- **Confidentiality:** High (Full access to all cluster secrets and data)
- **Integrity:** High (Ability to modify any cluster resource)
- **Availability:** High (Ability to delete or disrupt any cluster service)
## Remediation
### Patches
Red Hat recommends updating to the latest version of RHACM where this flaw is addressed. Users should check the Red Hat Customer Portal for the specific Errata associated with RHACM 2.x.
- Red Hat Security Advisories: hxxps[://]access[.]redhat[.]com/security/security-updates/security-advisories
### Workarounds
- **Strict RBAC Policy:** Review and restrict "edit" permissions on namespaces to trusted users only.
- **Policy Enforcement:** Use Open Policy Agent (OPA) or Gatekeeper to prevent the creation of `ClusterRoleBindings` through Application Subscription manifests.
## Detection
- **Audit Logs:** Monitor Kubernetes API audit logs for the creation of `ClusterRoleBindings` originating from the `multicluster-operators-subscription` service account.
- **Resource Inspection:** Inspect existing `Application Subscription` resources for manifests that include cluster-scoped roles or bindings.
## References
- Red Hat CVE Database: hxxps[://]access[.]redhat[.]com/security/cve/cve-2026-10090
- Bugzilla Report 2483292: hxxps[://]bugzilla[.]redhat[.]com/show_bug[.]cgi?id=2483292
- Canadian Centre for Cyber Security Bulletin: hxxps[://]www[.]cyber[.]gc[.]ca/fr/alertes-avis/bulletin-securite-red-hat-av26-803