CVE-2026-10090

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes (ACM) (affected versions not specified)

Description A flaw in the Application Subscription controller (multicluster-operators-subscription) allows a user with namespace-scoped edit privileges in an ACM hub namespace to escalate privileges to cluster-admin. An attacker can create a Channel resource pointing to a controlled Helm repository and a Subscription resource referencing it. The controller then fetches and applies the Helm chart contents using its own elevated authority without verifying if the creator has the open-cluster-management:subscription-admin role or restricting resources to the subscription namespace. This enables the inclusion of cluster-scoped resources, such as a ClusterRoleBinding, in the Helm chart to grant the attacker's ServiceAccount the cluster-admin ClusterRole.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.