Privilege Escalation in Red Hat ACM Lets Namespace Editors Become Cluster Admin

Red Hat Advanced Cluster Management for Kubernetes 2 is affected by CVE-2026-10090, an Important privilege escalation flaw in the multicluster-operators-subscription component that can let a user with namespace-scoped edit rights gain full cluster-admin access. Red Hat assigned the issue a CVSS v3.1 score of 9.9, and the Canadian Centre for Cyber Security issued advisory AV26-803 urging organizations to review Red Hat guidance and apply updates when available.

According to Red Hat's bug report and CVE record, the Application Subscription controller can be abused by creating a malicious Channel and Subscription that point to an attacker-controlled Helm repository. The controller then applies the Helm chart with elevated privileges without verifying the creator holds the required open-cluster-management:subscription-admin role and without restricting deployed resources to the subscription namespace, allowing deployment of cluster-scoped objects such as a ClusterRoleBinding that grants the attacker's ServiceAccount the cluster-admin ClusterRole. Red Hat said no mitigation meeting its product security criteria is currently available, and credited Christopher Lusk of North Echo Security Research with reporting the flaw.