Privilege Escalation Vulnerability in Multicloud Operators Subscription by Red Hat

CVE-2026-66792

What is CVE-2026-66792?

A security flaw exists in the multicloud-operators-subscription component, which permits users on managed clusters to escalate their privileges by creating a Subscription with specifically crafted annotations. This exploitation allows an attacker to deploy resources into any namespace using the elevated permissions of the controller's Service Account, potentially resulting in unauthorized access and increased control over cluster resources.

References