Full Report
Red Hat security advisory (AV26-803)
Analysis Summary
# Vulnerability: Privilege Escalation in Red Hat Advanced Cluster Management via Application Subscription
## CVE Details
- **CVE ID:** CVE-2026-10090
- **CVSS Score:** 8.8 (High) - *Calculated based on typical privilege escalation metrics for this component.*
- **CWE:** CWE-250 (Execution with Unnecessary Privileges) / CWE-269 (Improper Privilege Management)
## Affected Systems
- **Products:** Red Hat Advanced Cluster Management for Kubernetes (RHACM)
- **Versions:** RHACM version 2.x
- **Configurations:** Systems utilizing the `multicluster-operators-subscription` component where users have namespace-level edit permissions.
## Vulnerability Description
A flaw exists in the `multicluster-operators-subscription` component of Red Hat Advanced Cluster Management. The vulnerability allows a user who has permissions to edit a specific namespace to bypass intended restrictions. Specifically, an attacker can use an Application Subscription to deploy a cluster-scoped `ClusterRoleBinding`. Because the operator handles these subscriptions with elevated privileges, the user can effectively grant themselves `cluster-admin` rights, leading to full control over the managed cluster.
## Exploitation
- **Status:** Not reported as exploited in the wild (as of advisory date).
- **Complexity:** Low
- **Attack Vector:** Network (Authenticated)
- **Privileges Required:** Low/Medium (Namespace-level "edit" access)
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
- **Total Impact:** Full administrative takeover of the Kubernetes cluster.
## Remediation
### Patches
Red Hat has released security updates to address this flaw. Administrators are advised to update Red Hat Advanced Cluster Management to the latest available version (refer to the Red Hat Customer Portal for specific errata versions).
- [Red Hat Security Advisories](https://access.redhat.com/security/security-updates/security-advisories)
### Workarounds
No specific official workaround is provided. Mitigation involves strictly limiting "edit" permissions on namespaces to trusted users and monitoring the creation of `ClusterRoleBindings` through Application Subscriptions.
## Detection
- **Indicators of Compromise:** Unusual `ClusterRoleBinding` objects created by the `multicluster-operators-subscription` service account.
- **Detection Methods:**
- Audit Kubernetes API logs for `create` or `update` events on `ClusterRoleBinding` resources initiated by the subscription operator.
- Monitor RHACM Application Subscription manifests for inclusions of cluster-scoped resources.
## References
- hxxps://access[.]redhat[.]com/security/cve/cve-2026-10090
- hxxps://bugzilla[.]redhat[.]com/show_bug[.]cgi?id=2483292
- hxxps://access[.]redhat[.]com/security/security-updates/security-advisories