CVE-2026-10090
Received Received - Intake

Privilege Escalation in Red Hat Advanced Cluster Management

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Red Hat, Inc.

Description
A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-10090
EUVD
EUVD-2026-53294

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat advanced_cluster_management_for_kubernetes From 2026-05-29 (inc) to 2026-08-05 (inc)
red_hat advanced_cluster_management_for_kubernetes *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-267 A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in Red Hat Advanced Cluster Management (ACM) for Kubernetes. A user with limited namespace-scoped edit privileges can exploit the Application Subscription controller to gain full cluster-admin access. The attacker creates a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The controller then applies the Helm chart contents with elevated authority, allowing the inclusion of cluster-scoped resources like a ClusterRoleBinding that grants the attacker cluster-admin privileges.

Detection Guidance

Check for unauthorized ClusterRoleBindings or elevated permissions in your ACM hub namespace. Inspect Helm charts deployed via Subscription resources for cluster-scoped resources. Review logs of the multicluster-operators-subscription controller for suspicious activity.

Impact Analysis

If exploited, this vulnerability allows an attacker with basic namespace privileges to escalate to full cluster-admin access. This means they can take complete control of the Kubernetes cluster, install malicious software, steal data, disrupt operations, or pivot to other systems. The high CVSS score of 9.9 indicates severe impact.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data and systems. Full cluster compromise violates data protection requirements, audit controls, and access management policies mandated by these standards. Organizations using ACM may face compliance violations and regulatory penalties.

Mitigation Strategies

Restrict namespace-scoped 'edit' privileges in ACM hub namespaces. Monitor and audit Subscription and Channel resources for unauthorized modifications. Consider disabling the Application Subscription controller if not required until a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart