Role-Based Access Control Vulnerability in Multicluster Global Hub Operator by Red Hat
CVE-2026-110744

7.2HIGH

Key Information:

Vendor

Red Hat
Status
Multicluster Global Hub
Vendor
CVE Published:
21 October 2026

What is CVE-2026-110744?

A significant vulnerability exists within the Multicluster Global Hub Operator, related to the role-based access control (RBAC) configuration. The operator has been found to possess excessively permissive RBAC permissions that allow for cluster-wide impersonation of users, groups, and service accounts without appropriate limitations. If an attacker successfully compromises the operator or acquires its service account credentials, they can potentially escalate privileges and gain full administrative access to the entire cluster, posing a severe security risk.

References

https://access.redhat.com/security/cve/CVE-2026-110744
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2523007
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.