Red Hat has announced a serious security vulnerability, identified as CVE-2026-10090, within its Advanced Cluster Management for Kubernetes (ACM) software. This flaw, located in the Application Subscription controller, poses a significant risk as it could allow unauthorized users to elevate their privileges to gain full cluster-admin access.
Understanding the Vulnerability
Rated as Important with a CVSS score of 9.9, the vulnerability affects users with namespace-scoped “edit” permissions on an ACM hub. These users could potentially escalate their privileges, granting them control over the entire cluster environment. The issue stems from the multicluster-operators-subscription component, which is integral to ACM’s Application Subscription feature.
According to Red Hat, a user with basic edit rights in a hub namespace can exploit this flaw by creating a Channel resource linked to a personally controlled Helm repository. This would then connect to a Subscription resource referencing the same channel. Critically, the controller processes these requests with elevated permissions without verifying if the user has the necessary “open-cluster-management:subscription-admin” role.
Implications of the Security Flaw
The absence of proper authorization checks allows attackers to include cluster-scoped objects in their Helm charts, such as a ClusterRoleBinding. This binding can connect their ServiceAccount to the “cluster-admin” ClusterRole, effectively granting full administrative privileges upon application by the controller.
Classified under CWE-267, Privilege Defined With Unsafe Actions, this flaw is documented as Bugzilla entry 2483292. Its severity is underscored by the fact that it contradicts ACM’s security model, which restricts non-admin users to deploying resources within their own namespaces.
Protecting Against Potential Exploits
Organizations using ACM for multi-tenant separation across managed clusters could inadvertently expose their environments to exploitation by users with mere edit-level access. This access is often broadly granted to developers, increasing the risk of widespread control over clustered resources.
Red Hat has highlighted that no straightforward mitigation currently aligns with their deployment and stability requirements. The affected package is identified as rhacm2/multicluster-operators-subscription-rhel9 in Red Hat ACM for Kubernetes 2, with its status marked as “Affected.”
In the absence of an official patch, Red Hat advises security teams to audit namespace-scoped edit permissions, monitor the creation of Channel and Subscription resources, and limit subscription-admin rights to trusted personnel. Additionally, implementing admission control policies to block cluster-scoped resources during application subscriptions is recommended as a temporary safeguard.
As Red Hat works on a comprehensive solution, organizations must remain vigilant to prevent potential exploitation of this critical vulnerability.
.webp?ssl=1 "Google’s reCAPTCHA Update Challenges Privacy Advocates")
