EUVD-2026-60322
GHSA-8jj2-p7p7-6mr3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Kubernetes API is network-reachable (AV:N) with low complexity; a low-privilege user who can create a Subscription (PR:L) escalates to the controller Service Account, crossing an authority boundary (S:C) with full cluster CIA impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
AnalysisAI
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege identity on a managed cluster that can create a Subscription custom resource (CVSS PR:L), and the crafted, attacker-controlled annotations on that Subscription are the exact trigger named in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) is internally consistent with the description: a network-reachable Kubernetes API, low complexity, only low privileges required (any user who can create a Subscription on a managed cluster), no user interaction, and a genuine scope change because a low-privileged actor gains the controller Service Account's cluster-wide reach. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with an ordinary, low-privilege account on a managed cluster creates a Subscription object embedding specially crafted annotations that instruct the controller to deploy resources into a namespace the attacker cannot normally write to. The multicloud-operators-subscription controller reconciles the object using its own elevated Service Account, planting attacker-defined workloads or RBAC objects cluster-wide. … |
| Remediation | No vendor-released patch version is identified in the provided data, so the primary action is to consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-66792) and Bugzilla 2507537 (https://bugzilla.redhat.com/show_bug.cgi?id=2507537) for fixed ACM and Multicluster Global Hub errata and upgrade to the exact patched release once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and document all Red Hat ACM 2.x and Multicluster Global Hub deployments and current access patterns for managed clusters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multicluster Global Hub
View allInsufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent
Red Hat multicluster-global-hub misconfigures topic-level access controls during ManagedClusterMigration, exposing boots
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today