← CVE Intelligence

CVE-2026-66792

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters PUBLISHED

Description (CNA)

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

Affected (CNA)

Vendor / productVersions
Red Hat / Multicluster Global Hub 1.4.9unaffected 1788355439 before *
Red Hat / Multicluster Global Hub 1.4.9unaffected 1788355599 before *
Red Hat / Multicluster Global Hub 1.4.9unaffected 1788355417 before *
Red Hat / Multicluster Global Hub 1.5.8unaffected 1789515408 before *
Red Hat / Multicluster Global Hub 1.5.8unaffected 1789515288 before *
Red Hat / Multicluster Global Hub 1.5.8unaffected 1789478830 before *
Red Hat / Multicluster Global Hub 1.6.6unaffected 1790085494 before *
Red Hat / Multicluster Global Hub 1.6.6unaffected 1790086176 before *
Red Hat / Multicluster Global Hub 1.6.6unaffected 1790085268 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11unaffected 1787262214 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11unaffected 1787263584 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13unaffected 1787259284 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13unaffected 1787263693 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14unaffected 1786976940 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14unaffected 1787170830 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.15unaffected 1787238598 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.15unaffected 1787240030 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1787242135 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1787242321 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1787242131 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1787242108 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2unaffected
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2unaffected
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2unaffected
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2unaffected
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2unaffected
Red Hat / Red Hat OpenShift Container Platform 4affected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4affected
Red Hat / Red Hat Openshift Data Foundation 4unaffected
Red Hat / Red Hat Openshift Data Foundation 4unaffected
Red Hat / Red Hat Openshift Data Foundation 4unaffected

CWE

CWE-863

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.