Riskcovery

CVE-2026-66792

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

State
Published
Severity
9.9 Critical
Published
Aug 17, 2026
Updated
Sep 29, 2026
Reserved
Jul 27, 2026

Read the record on cve.org

Description

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hredhat

Weaknesses

Affected Products

ProductVersions
Multicluster Global Hub 1.4.9Red Hat
  • 1788355439 and laterNot affected
Multicluster Global Hub 1.4.9Red Hat
  • 1788355599 and laterNot affected
Multicluster Global Hub 1.4.9Red Hat
  • 1788355417 and laterNot affected
Multicluster Global Hub 1.5.8Red Hat
  • 1789515408 and laterNot affected
Multicluster Global Hub 1.5.8Red Hat
  • 1789515288 and laterNot affected
Multicluster Global Hub 1.5.8Red Hat
  • 1789478830 and laterNot affected
Multicluster Global Hub 1.6.6Red Hat
  • 1790085494 and laterNot affected
Multicluster Global Hub 1.6.6Red Hat
  • 1790086176 and laterNot affected
Multicluster Global Hub 1.6.6Red Hat
  • 1790085268 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.11Red Hat
  • 1787262214 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.11Red Hat
  • 1787263584 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.13Red Hat
  • 1787259284 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.13Red Hat
  • 1787263693 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.14Red Hat
  • 1786976940 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.14Red Hat
  • 1787170830 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.15Red Hat
  • 1787238598 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.15Red Hat
  • 1787240030 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat
  • 1787242135 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat
  • 1787242321 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat
  • 1787242131 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat
  • 1787242108 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
    Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
      Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
        Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
          Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
            Red Hat OpenShift Container Platform 4Red Hat
              Red Hat OpenShift Container Platform 4Red Hat
                Red Hat OpenShift Container Platform 4Red Hat
                  Red Hat OpenShift Container Platform 4Red Hat
                    Red Hat OpenShift Container Platform 4Red Hat
                      Red Hat OpenShift Container Platform 4Red Hat
                        Red Hat OpenShift Container Platform 4Red Hat
                          Red Hat OpenShift Container Platform 4Red Hat
                            Red Hat OpenShift Container Platform 4Red Hat
                              Red Hat Openshift Data Foundation 4Red Hat
                                Red Hat Openshift Data Foundation 4Red Hat
                                  Red Hat Openshift Data Foundation 4Red Hat

                                    References

                                    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.