Description
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Multicluster Global Hub 1.4.9
Default version status: affected
1788355439 to < *unaffected
Red Hat Multicluster Global Hub 1.4.9
Default version status: affected
1788355599 to < *unaffected
Red Hat Multicluster Global Hub 1.4.9
Default version status: affected
1788355417 to < *unaffected
Red Hat Multicluster Global Hub 1.5.8
Default version status: affected
1789515408 to < *unaffected
Red Hat Multicluster Global Hub 1.5.8
Default version status: affected
1789515288 to < *unaffected
Red Hat Multicluster Global Hub 1.5.8
Default version status: affected
1789478830 to < *unaffected
Red Hat Multicluster Global Hub 1.6.6
Default version status: affected
1790085494 to < *unaffected
Red Hat Multicluster Global Hub 1.6.6
Default version status: affected
1790086176 to < *unaffected
Red Hat Multicluster Global Hub 1.6.6
Default version status: affected
1790085268 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
Default version status: affected
1787262214 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
Default version status: affected
1787263584 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
Default version status: affected
1787259284 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
Default version status: affected
1787263693 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
Default version status: affected
1786976940 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
Default version status: affected
1787170830 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
Default version status: affected
1787238598 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
Default version status: affected
1787240030 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
Default version status: affected
1787242135 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
Default version status: affected
1787242321 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17
Default version status: affected
1787242131 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17
Default version status: affected
1787242108 to < *unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat Openshift Data Foundation 4
Default version status: unaffected
Red Hat Red Hat Openshift Data Foundation 4
Default version status: unaffected
Red Hat Red Hat Openshift Data Foundation 4
Default version status: unaffected
References
- https://access.redhat.com/errata/RHSA-2026:60386 ↗
- https://access.redhat.com/errata/RHSA-2026:60387 ↗
- https://access.redhat.com/errata/RHSA-2026:60388 ↗
- https://access.redhat.com/errata/RHSA-2026:60389 ↗
- https://access.redhat.com/errata/RHSA-2026:60390 ↗
- https://access.redhat.com/errata/RHSA-2026:60391 ↗
- https://access.redhat.com/errata/RHSA-2026:67516 ↗
- https://access.redhat.com/errata/RHSA-2026:71597 ↗
- https://access.redhat.com/errata/RHSA-2026:73419 ↗
- https://access.redhat.com/security/cve/CVE-2026-66792 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2507537 ↗