9.9Critical
CVE-2026-66792Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters
Description
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
Weakness (CWE):
CWE-863
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| acm | 2.11 | — | |
| acm | 2.13 | — | |
| acm | 2.14 | — | |
| acm | 2.15 | — | |
| acm | 2.16 | — | |
| acm | 2.17 | — | |
| multicluster globalhub | 1.4 | — | |
| multicluster globalhub | 1.5 | — | |
| multicluster globalhub | 1.6 | — | |
| Red Hat | Multicluster Global Hub 1.4.9 | all versions | |
| Red Hat | Multicluster Global Hub 1.5.8 | all versions | |
| Red Hat | Multicluster Global Hub 1.6.6 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4 | all versions | |
| Red Hat | Red Hat Openshift Data Foundation 4 | — |
References and patches
- RHSA-2026:60386 vendor-advisory
- RHSA-2026:60387 vendor-advisory
- RHSA-2026:60388 vendor-advisory
- RHSA-2026:60389 vendor-advisory
- RHSA-2026:60390 vendor-advisory
- RHSA-2026:60391 vendor-advisory
- RHSA-2026:67516 vendor-advisory
- RHSA-2026:71597 vendor-advisory
- RHSA-2026:73419 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-66792 vdb-entry
- RHBZ#2507537 issue-tracking