CVE-2026-10079
Received Received - Intake

Red Hat ACS Deployment Identity Metadata Bypass

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Red Hat, Inc.

Description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name and labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-10079
EUVD
EUVD-2026-51508

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat advanced_cluster_security_for_kubernetes *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Red Hat Advanced Cluster Security for Kubernetes (RHACS) allows a user with Deployment creation permissions to bypass security policies by setting a specific label to 'null'. This causes RHACS to misidentify the deployment's identity, leading to incorrect policy enforcement and visibility gaps.

Detection Guidance

To detect this vulnerability, inspect Kubernetes Deployments for the label 'openshift.io/encoded-deployment-config' set to 'null'. Check RHACS logs for missing deploy-time policy violations or workloads defaulting to namespace 'default'. Use commands like 'kubectl get deployments --all-namespaces -o jsonpath='{.items[*].metadata.labels.openshift\.io/encoded-deployment-config}' to find affected deployments.

Impact Analysis

An attacker with Deployment permissions could exploit this to evade security checks, hide malicious workloads, and prevent proper compliance reporting. This undermines security monitoring and may allow unauthorized or malicious deployments to operate undetected.

Compliance Impact

This flaw breaks compliance correlation by misrepresenting deployment identities, making it impossible to accurately track violations or enforce policies. This could lead to non-compliance with regulations requiring audit trails and security controls.

Mitigation Strategies

Update Red Hat Advanced Cluster Security for Kubernetes to the latest version to address the flaw in deployment identity metadata handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart