Critical cybersecurity update: Red Hat ACM Privilege Escalation Vulnerability Lets Attackers Gain Full Cluster-Admin Access. The report references CVE-2026-10090. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Red Hat has disclosed a critical privilege escalation flaw, tracked as CVE-2026-10090, affecting the Application Subscription controller in Red Hat Advanced Cluster Management for Kubernetes (ACM). Rated Important with a CVSS score of 9.9, the vulnerability allows a user with only namespace-scoped “edit” permissions on an ACM hub to escalate all the way to full […] The post Red Hat ACM Privilege Escalation Vulnerability Lets Attackers Gain Full Cluster-Admin Access appeared first on Cyber Security News . Red Hat ACM Privilege Escalation Vulnerability Lets Attackers Gain Full Cluster-Admin Access Red Hat has disclosed a critical privilege escalation flaw, tracked as CVE-2026-10090, affecting the Application Subscription controller in Red Hat Advanced Cluster Management for Kubernetes (ACM). Rated Important with a CVSS score of 9.9, the vulnerability allows a user with only namespace-scoped “edit” permissions on an ACM hub to escalate all the way to full cluster-admin rights, effectively handing low-privilege insiders control over the entire managed cluster fleet . The bug resides in the multicluster-operators-subscription component, which powers ACM’s Application Subscription feature. According to Red Hat’s advisory, a user holding basic edit privileges in a hub namespace can create a Channel resource pointing to a Helm repository they personally control, then link it to a Subscription resource that references that channel. The app-subscription controller processes this request using its own elevated service account authority rather than the requester’s actual permissions. Critically, it never checks whether the person creating the subscription actually holds the “open-cluster-management:subscription-admin” role, and it fails to restrict the resources being deployed to the subscription’s own namespace.
Technical Details
The vulnerability identifiers associated with this report are CVE-2026-10090. The highest CVSS score detected in the available material is 9.9. Because of this missing authorization check, an attacker can embed cluster-scoped objects inside their malicious Helm chart, most notably a ClusterRoleBinding that binds their own ServiceAccount to the built-in “cluster-admin” ClusterRole. Once the controller applies the chart, that binding is created with full privileges, and the attacker instantly becomes a cluster administrator. Red Hat classifies the underlying weakness as CWE-267, Privilege Defined With Unsafe Actions, and the flaw is documented under Bugzilla entry 2483292. This vulnerability is particularly severe because it directly contradicts ACM’s own documented security model, which states that non-subscription-admin users should only ever be able to deploy resources into their own subscription namespace. Organizations relying on ACM to enforce multi-tenant separation across hub-managed clusters could unknowingly be exposing every managed cluster to takeover by any user who merely has edit-level access to a single namespace, a permission level often granted broadly to developers and application teams. Given that ACM is widely deployed in enterprise and government environments to centrally govern fleets of OpenShift and Kubernetes clusters, successful exploitation could cascade far beyond a single namespace, granting attackers the ability to read secrets, modify workloads, or pivot into every cluster registered with that hub. Red Hat’s advisory notes that no dedicated mitigation currently meets the company’s criteria for ease of deployment, applicability across installations, or long-term stability. The affected package is identified as rhacm2/multicluster-operators-subscription-rhel9 under Red Hat Advanced Cluster Management for Kubernetes 2, and its current state is listed as “Affected” with no errata yet issued. Until an official patch or errata is released, security teams should audit who holds namespace-scoped edit access on ACM hub namespaces, closely monitor Channel and Subscription resource creation for unauthorized Helm repository references, and restrict subscription-admin privileges strictly to trusted operators.
Security Impact
Organizations using the affected technology should treat the report according to its critical severity classification. The presence of a tracked CVE gives defenders a concrete identifier to use when checking vendor advisories, vulnerability scanners, asset inventories and patch-management systems. Enabling admission control policies that block cluster-scoped resources from being deployed via application subscriptions is also advisable as an interim compensating control while Red Hat finalizes a fix. Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response Google Play Apps Use Stealth Loaders to Deliver Anatsa Banking Malware Ransomware Operators Disable EDR, Backup Software and Windows Telemetry Before Encryption Valve Steam Hardware Buyers Hit by CEVA Logistics Data Breach Apple Private Cloud Compute Flaw Enables Root File Writes and AI Inference Telemetry Leakage From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage Your Incident Response Plan Has a Dependency You Never Approved Security in the AI Era Starts with First Principles Planning Your AI Security – How will You Manage All Your Resources? Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Global malware activity climbed sharply over the past week,… Ransomware Gangs Attack Palo Alto, Fortinet, Citrix, and Check Point VPNs to Target Corporate Networks A coordinated wave of exploitation targeting edge VPN and…
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Critical
- CVE: CVE-2026-10090
- CVSS Score: 9.9
- CISA KEV: No match detected in the current catalog.
- Original source: Cybersecurity News
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from Cybersecurity News for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
