Reported by 2 outlets

Timeline

1. original reporting

   Red Hat ACM Flaw Lets Namespace Editors Escalate to Full Kubernetes Cluster-Admin

   cyberpress.org · 64d ago · August 11th, 2026

   CVE-2026-10090 (CVSS 9.9) is a critical privilege-escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes, rooted in the Application Subscription controller (multicluster-operators-subscription), that lets a user with limited namespace-level editing permissions obtain full cluster-admin access across the cluster. The flaw, made public August 5, breaks a core Kubernetes authorization boundary — the separation between namespace-scoped and cluster-scoped permissions. Patch ACM immediately and audit for unexpected cluster-admin grants.

2. update from gbhackers.com

   Red Hat Kubernetes Flaw Allows Attackers to Escalate Privileges to Cluster-Admin

   gbhackers.com · 63d ago · August 11th, 2026

   CVE/vulnerability Cyber Security News Vulnerability 2 min. Red Hat Kubernetes Flaw Allows Attackers to Escalate Privileges to Cluster-Admin By Divya August 11, 2026 Red Hat has disclosed a privilege-escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes (ACM) that could allow a low-privileged user to gain full cluster-admin control of an affected hub cluster. It has a CVSS v3.1 score of 9.9 out of 10. Red Hat Kubernetes Flaw The issue arises from an authorisation gap in ACM’s application-subscription workflow. A user with namespace-scoped edit permissions in an ACM hub namespace can create a Channel object that points to an attacker-controlled Helm repository. They can then create a Subscription that refers to that Channel. The vulnerable controller retrieves and deploys the chart using its own elevated permissions. Importantly, the controller does not verify whether the creator of the Subscription has the open-cluster-management:subscription-admin role, nor does it enforce the proper namespace boundaries on resources delivered through the Helm chart. This creates a “confused deputy” problem: a user with delegated namespace rights can cause a privileged controller to perform cluster-wide actions on their behalf.

3. update from cyberpress.org

   Red Hat ACM Flaw Lets Namespace Editors Escalate to Full Kubernetes Cluster Admin

   cyberpress.org · 63d ago · August 11th, 2026

   Red Hat assigned the issue an Important severity rating and a CVSS v3.1 score of 9.9 out of 10. Red Hat ACM Flaw The issue is especially significant because it violates a core Kubernetes authorization boundary: the separation between permissions granted within a namespace and permissions that apply across the entire cluster. In a vulnerable ACM hub, an attacker does not need pre-existing cluster-wide administrative rights. Crucially, Red Hat said the controller does not verify whether the user who created the Subscription holds the required open-c