What is the CVSS score of CVE-2026-10079?

CVE-2026-10079 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of RHACS are affected by CVE-2026-10079?

Red Hat Advanced Cluster Security for Kubernetes 4 contains a policy bypass vulnerability (CVE-2026-10079, CVSS 8.5) that allows users with Deployment-create permissions to spoof workload identity,…

How to fix or mitigate CVE-2026-10079?

Within 24 hours: Identify and inventory all Red Hat ACS 4 deployments and personnel with Kubernetes Deployment-create permissions. Notify security operations of the policy bypass risk. Within 7 days: Restrict Deployment-create permissions to minimally required personnel; implement monitoring and alerting for suspicious openshift.io/encoded-deployment-config label usage; audit recent deployment records for workloads with empty UIDs, missing names, or default namespaces. Within 30 days: Conduct forensic review of deployment audit logs for evidence of exploitation; manually reconcile ACS compliance records against external workload inventory to detect data corruption; establish regular review cadence for anomalous workload records. Note: No vendor-released patch identified at time of analysis-monitor Red Hat security advisories for patch availability.

RHACS CVE-2026-10079

EUVD-2026-51508 HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-31 redhat

GHSA-vq3f-pc8h-pv73

Authentication Bypass Kubernetes Red Hat Red Hat Advanced Cluster Security 4 Red Hat

8.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

vuln.today AI

7.7 HIGH

Needs Deployment-create RBAC (PR:L) over the k8s API (AV:N/AC:L/UI:N); corrupts identity data in Central (S:C, I:H); no genuine confidentiality or availability impact, so C:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Red Hat

8.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 09:52 vuln.today

CVE Published

Jul 31, 2026 - 09:08 cve.org

HIGH 8.5

DescriptionCVE.org

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name and labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.

Articles & Coverage 1

News 3 New Kubernetes Vulnerabilities - 3 High Severity Jul 31, 2026

AnalysisAI

Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Red Hat Advanced Cluster Security (RHACS, formerly StackRox) is a Kubernetes/OpenShift-native security platform whose sensors ingest Deployment objects and forward normalized workload metadata to the central component (Central) for policy evaluation, violation tracking and compliance correlation. The affected CPE is cpe:2.3:a:red_hat:red_hat_advanced_cluster_security_4, i.e. the RHACS 4.x product line. The root cause maps to CWE-345 (Insufficient Verification of Data Authenticity): ACS trusts the attacker-controllable openshift.io/encoded-deployment-config label as authoritative deployment identity metadata instead of deriving identity from the trusted Kubernetes API object fields (uid, name, namespace, labels). When that label is set to the literal "null", the parsing logic substitutes empty/default identity values, so the workload is mis-keyed and slips through the identity-dependent policy and enforcement pipeline.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-10079 and apply the fixed RHACS 4.x release once published; no exact fixed version is confirmed in the available data, so verify the patched build directly from that advisory and Bugzilla 2483158 before deploying. As compensating controls until patched, tighten RBAC so only trusted service accounts and CI pipelines hold create/update permission on Deployments to bound who can set the malicious label (at the cost of workflow friction for developers who self-deploy); deploy a Kubernetes admission controller such as OPA/Gatekeeper or Kyverno to reject or strip the openshift.io/encoded-deployment-config label, or specifically reject the literal value "null", on incoming Deployments (side effect: may interfere with legitimate OpenShift tooling that sets this annotation, so run in audit mode first); and audit Central for workloads reporting empty UID/name or an unexpected "default" namespace as an indicator of attempted abuse. Do not rely solely on ACS deploy-time enforcement while the flaw is unpatched, since it is the control being bypassed.