What is the CVSS score of CVE-2026-66792?

CVE-2026-66792 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Red Hat ACM are affected by CVE-2026-66792?

A privilege escalation vulnerability in Red Hat Advanced Cluster Management 2.x and Multicluster Global Hub (CVE-2026-66792, CVSS 9.9) allows any authenticated cluster user to bypass deployment…

How to fix or mitigate CVE-2026-66792?

Within 24 hours: identify and document all Red Hat ACM 2.x and Multicluster Global Hub deployments and current access patterns for managed clusters. Within 7 days: implement RBAC policies to restrict Subscription object creation and modification to administrative users only; review all existing Subscription objects for suspicious annotations; enable audit logging for the subscription controller. Within 30 days: monitor Red Hat security advisories for patch availability and develop a deployment plan; when the vendor patch is released, schedule and execute upgrades starting with production environments. Until patching is available, enforce network segmentation to limit low-privileged user access to cluster management APIs and isolate managed clusters from untrusted networks.

Red Hat ACM CVE-2026-66792

EUVD-2026-60322 CRITICAL

Incorrect Authorization (CWE-863)

2026-08-17 redhat

GHSA-8jj2-p7p7-6mr3

Authentication Bypass Red Hat Openshift Container Platform 4 Red Hat Openshift Data Foundation 4 Red Hat Advanced Cluster Management For Kubernetes 2 Multicluster Global Hub Red Hat

9.9

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Kubernetes API is network-reachable (AV:N) with low complexity; a low-privilege user who can create a Subscription (PR:L) escalates to the controller Service Account, crossing an authority boundary (S:C) with full cluster CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.9 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 19:05 vuln.today

CVE Published

Aug 17, 2026 - 18:12 cve.org

CRITICAL 9.9

DescriptionCVE.org

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

AnalysisAI

Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The multicloud-operators-subscription component is part of Red Hat Advanced Cluster Management (ACM) for Kubernetes and its Multicluster Global Hub, implementing GitOps-style application delivery where a Subscription custom resource tells a controller what to deploy onto managed clusters. The controller runs with a broad, cluster-scoped Service Account so it can reconcile resources across namespaces. The root cause is CWE-863 (Incorrect Authorization): the controller trusts attacker-controllable annotations on a Subscription to decide target namespace and deployment context without adequately verifying that the requesting user is authorized for that target, so a user's own low-privilege identity is effectively swapped for the controller's Service Account permissions. Affected CPEs are red_hat:red_hat_advanced_cluster_management_for_kubernetes_2 and red_hat:multicluster_global_hub.

RemediationAI

No vendor-released patch version is identified in the provided data, so the primary action is to consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-66792) and Bugzilla 2507537 (https://bugzilla.redhat.com/show_bug.cgi?id=2507537) for fixed ACM and Multicluster Global Hub errata and upgrade to the exact patched release once published. Until a fix is applied, restrict who can create or modify Subscription resources on managed clusters by tightening RBAC (limit the subscriptions.apps.open-cluster-management.io create/update verbs to trusted principals), which directly removes the attacker's entry point at the cost of constraining self-service GitOps workflows. Additionally, monitor and, if feasible, admission-control (e.g., a validating webhook or OPA/Kyverno policy) the specific crafted annotations on Subscription objects and audit for Subscriptions targeting namespaces the creator does not own; the trade-off is added policy maintenance and potential false positives against legitimate multi-namespace deployments.