Privilege Escalation Vulnerability in Multicloud Operators Subscription by Red Hat
CVE-2026-66792

9.9CRITICAL

Key Information:

Vendor

Red Hat
Status
Multicluster Global Hub
Red Hat Advanced Cluster Management For Kubernetes 2
Red Hat Openshift Container Platform 4
Red Hat Openshift Data Foundation 4
Vendor
CVE Published:
17 August 2026

What is CVE-2026-66792?

A security flaw exists in the multicloud-operators-subscription component, which permits users on managed clusters to escalate their privileges by creating a Subscription with specifically crafted annotations. This exploitation allows an attacker to deploy resources into any namespace using the elevated permissions of the controller's Service Account, potentially resulting in unauthorized access and increased control over cluster resources.

References

https://access.redhat.com/security/cve/CVE-2026-66792
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2507537
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.