Full Report
Red Hat security advisory (AV26-803)
Analysis Summary
# Vulnerability: Privilege Escalation in Red Hat Advanced Cluster Management via Application Subscription
## CVE Details
- **CVE ID:** CVE-2026-10090
- **CVSS Score:** 8.8 (High) - *Estimated based on standard privilege escalation in K8s environments.*
- **CWE:** CWE-250 (Execution with Unnecessary Privileges) / CWE-269 (Improper Privilege Management)
## Affected Systems
- **Products:** Red Hat Advanced Cluster Management (RHACM) for Kubernetes
- **Versions:** RHACM version 2.x (specifically components utilizing `multicluster-operators-subscription`)
- **Configurations:** Systems where users have "namespace edit" permissions and the Application Subscription model is in use.
## Vulnerability Description
A flaw was discovered in the `multicluster-operators-subscription` component of Red Hat Advanced Cluster Management. The vulnerability allows a user with limited "namespace edit" permissions to bypass security boundaries. By leveraging the Application Subscription mechanism, an attacker can deploy a cluster-scoped `ClusterRoleBinding`. This effectively allows the user to elevate their privileges to `cluster-admin`, granting full control over the Kubernetes cluster.
## Exploitation
- **Status:** Not reported as exploited in the wild (based on advisory date).
- **Complexity:** Low
- **Attack Vector:** Network (Authenticated)
- **Prerequisites:** Attacker must have existing edit access to at least one namespace.
## Impact
- **Confidentiality:** High (Total access to all secrets and data in the cluster)
- **Integrity:** High (Ability to modify any cluster resource)
- **Availability:** High (Ability to delete namespaces or shut down services)
## Remediation
### Patches
Red Hat recommends updating to the latest patched version of RHACM 2. Check the Red Hat Customer Portal for the specific minor version/errata associated with this fix.
- **Reference:** Red Hat Security Advisory (RHSA) for RHACM 2.
### Workarounds
- **Strict RBAC:** Audit and restrict "edit" permissions on namespaces, especially for untrusted users.
- **Policy Enforcement:** Use Admission Controllers (like Gatekeeper or Kyverno) to block the creation of `ClusterRoleBindings` through the Subscription operator by non-admin users.
## Detection
- **Indicators of Compromise:** Unusual `ClusterRoleBinding` objects created by service accounts associated with the `multicluster-operators-subscription`.
- **Detection Methods:**
- Review Kubernetes Audit Logs for `create` or `patch` operations on `clusterrolebindings` originating from the RHACM subscription controller.
- Monitor for unexpected elevations of privilege for users who previously only had namespace-level access.
## References
- hxxps[://]access[.]redhat[.]com/security/cve/cve-2026-10090
- hxxps[://]bugzilla[.]redhat[.]com/show_bug[.]cgi?id=2483292
- hxxps[://]access[.]redhat[.]com/security/security-updates/security-advisories