CVE-2026-10090

Full vulnerability record from the local CVENow database.

Description

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.

Severity

CRITICAL

CVSS score

9.0 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-08-05 09:18:14.667000

Last modified

2026-10-23 21:10:00.157000

View original CVE JSON

{
  "id": "CVE-2026-10090",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T09:18:14.667",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped \"edit\" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the \"open-cluster-management:subscription-admin\" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the \"cluster-admin\" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el controlador de suscripciones de aplicaciones (multicluster-operators-subscription) de Red Hat Advanced Cluster Management for Kubernetes (ACM). Un usuario con privilegios de ’edición’ con ámbito de espacio de nombres en un espacio de nombres de hub de ACM puede crear un recurso Channel que apunta a un repositorio Helm que controla y un recurso Subscription que lo referencia. El controlador app-subscription obtiene y aplica el contenido del gráfico Helm con su propia autoridad elevada, sin verificar si el creador de la suscripción posee el rol ’open-cluster-management:subscription-admin’ y sin restringir los recursos aplicados al espacio de nombres de la suscripción. Esto permite al atacante incluir recursos con ámbito de clúster en el gráfico Helm, como un ClusterRoleBinding que otorga a la ServiceAccount del atacante el ClusterRole ’cluster-admin’. La explotación exitosa resulta en una escalada de privilegios completa de cluster-admin. Esto contradice la documentación de ACM que establece que los usuarios no-subscription-admin solo deben tener recursos desplegados en el espacio de nombres de la suscripción."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.11::el9"
          ],
          "versions": [
            {
              "version": "1787263584",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.13::el9"
          ],
          "versions": [
            {
              "version": "1787263693",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.14::el9"
          ],
          "versions": [
            {
              "version": "1787170830",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.15::el9"
          ],
          "versions": [
            {
              "version": "1787240030",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "versions": [
            {
              "version": "1787242321",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "versions": [
            {
              "version": "1787242108",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T13:49:40.960456Z",
          "id": "CVE-2026-10090",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-267"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60386",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60387",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60388",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60389",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60390",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60391",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-10090",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483292",
      "source": "[email protected]"
    }
  ]
}