CVE-2026-66792

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription (affected versions not specified)

Description A flaw in the multicloud-operators-subscription component allows a user on a managed cluster to escalate privileges. By creating a Subscription with specifically crafted annotations, an attacker can deploy resources into any namespace using the elevated permissions of the controller's Service Account, potentially gaining unauthorized control over cluster resources. This occurs because the isclusteradmin() function trusts user-settable annotations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.