Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription
CVSS score
9.0
EPSS probability
%0.6
Risk score
0.1
Published
2 mo ago
Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
Tam uyum
Evidence confidence
%58
Short explanation
CVE-2026-10090 allows namespace-edit users in Red Hat Advanced Cluster Management for Kubernetes 2 to escalate to cluster-admin via misconfigured application subscriptions. No fixed version is known. Patch status is UNKNOWN. This contradicts ACM documentation on resource deployment scope.
This vulnerability allows unauthorized users to gain full cluster-admin access, posing severe risk to cluster integrity. It directly contradicts ACM's stated security model and enables privilege escalation without proper authorization checks.
What should be done?
- Apply vendor patch if available (patch status UNKNOWN)
- Review and restrict subscription creation permissions
- Validate role bindings and resource scope during subscription deployment
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
Red Hat Advanced Cluster Management for Kubernetes 2'de kritik bir eksiklik (CVE-2026-10090) mevcut olup, bir namespace-edit kullanıcısının uygulama abonelikleri aracılığıyla cluster-admin yetkisine yükseltildiğini sağlar.
Eksiklik, yetki doğrulaması ve namespace sınırlaması olmadan küme düzeyinde kaynaklar (örneğin, cluster-admin yetkilerini veren ClusterRoleBinding) yerleştirilmesini sağlar.
Bu eksiklik, ACM belgelerindeki 'non-subscription-admin kullanıcıların sadece abonelik namespace'inde kaynaklar yerleştirmesi gerektiği' ifadesini çiğrenir.
Show the technical text from the sources
A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
CWE: CWE-267
Explanation produced with the local qwen3:4b-instruct model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-10090 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | View |
| 2 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | View |
| 3 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | View |
| 4 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | View |
| 5 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | View |
| 6 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | View |
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 9.0 | CVSS V3_1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L | CVE CNA |
| 9.0 | CVSS V31 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L | NVD |
Patch and Remediation Guide
Solution & Remediation Advisory
İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-10090 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-10090 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Similar Vulnerabilities
spring-cloud-function: Remote code execution by malicious Spring Expression
activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Vulnerability in N/a
libwebp: Heap buffer overflow in WebP Codec
salt: salt-master process ClearFuncs class does not properly validate method calls
Deserialization of untrusted data in Red Hat, Inc. Jbossas
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-10090"