Read the docs
TI-2026-08844 Aliases CVE-2026-10090GHSA-g9vp-wj77-5767

Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit…

Priority MEDIUM 42CWE-267Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.11—1787263584Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—1787263693Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—1787170830Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—1787240030Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—1787242321Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.17—1787242108Patch availableCNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 VendorRed Hat Affected — Fixed in 1787263584 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 VendorRed Hat Affected — Fixed in 1787263693 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 VendorRed Hat Affected — Fixed in 1787170830 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 VendorRed Hat Affected — Fixed in 1787240030 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 VendorRed Hat Affected — Fixed in 1787242321 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 VendorRed Hat Affected — Fixed in 1787242108 Patch available CNA

CPE names CNA · 6

CPEVersionsRoleVendor
cpe:/a:redhat:acm:2.11::el92.11—Red Hat
cpe:/a:redhat:acm:2.13::el92.13—Red Hat
cpe:/a:redhat:acm:2.14::el92.14—Red Hat
cpe:/a:redhat:acm:2.15::el92.15—Red Hat
cpe:/a:redhat:acm:2.16::el92.16—Red Hat
cpe:/a:redhat:acm:2.17::el92.17—Red Hat
  • cpe:/a:redhat:acm:2.11::el9 Versions 2.11 — ·Red Hat
  • cpe:/a:redhat:acm:2.13::el9 Versions 2.13 — ·Red Hat
  • cpe:/a:redhat:acm:2.14::el9 Versions 2.14 — ·Red Hat
  • cpe:/a:redhat:acm:2.15::el9 Versions 2.15 — ·Red Hat
  • cpe:/a:redhat:acm:2.16::el9 Versions 2.16 — ·Red Hat
  • cpe:/a:redhat:acm:2.17::el9 Versions 2.17 — ·Red Hat

Remediation

Red Hat 6 advisories

  • RHSA-2026:60391 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
Show 3 more Red Hat advisories
  • RHSA-2026:60389 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:60389
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:60391
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Not affected: 6 products
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10090
  2. 2026-10-03 Alias added: GHSA-g9vp-wj77-5767

References

Advisory 6

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences