CVE-2026-10079: RHACS Kubernetes Auth Bypass Vulnerability

CVE-2026-10079 Overview

CVE-2026-10079 is a security flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) that allows authenticated users to bypass deploy-time policy enforcement. RHACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label when processing Kubernetes Deployments. A user with permission to create Deployments can set this label to "null", causing RHACS to treat the workload as having an empty UID, empty name, empty labels, and the default namespace. The flaw is classified under CWE-345 (Insufficient Verification of Data Authenticity).

Critical Impact
Attackers with Deployment creation rights can bypass RHACS policy detection, disable enforcement visibility, break violation reporting, and evade compliance correlation for malicious workloads.

Affected Products

Red Hat Advanced Cluster Security for Kubernetes (RHACS)
StackRox-based deployments processing the openshift.io/encoded-deployment-config label
OpenShift environments using RHACS Central for policy enforcement

Discovery Timeline

2026-07-31 - CVE-2026-10079 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-10079

Vulnerability Analysis

RHACS derives deployment identity metadata from an annotation-derived label rather than authoritative Kubernetes API fields. When RHACS ingests a Deployment, it parses the openshift.io/encoded-deployment-config label to reconstruct deployment identity. The parser accepts the literal string "null" as valid input. This causes Central to populate the deployment record with an empty UID, empty name, empty labels, and a hardcoded default namespace.

Deploy-time policies rely on this metadata for matching, enforcement, and reporting. With identity fields cleared, policy evaluation cannot associate the workload with rules that scope by namespace, name, or label selector. Violations either fail to generate or fail to persist correctly in Central. Compliance correlation and audit trails break for the affected Deployment.

Root Cause

The root cause is insufficient verification of data authenticity in the deployment ingestion path. RHACS trusts an attacker-controllable label to overwrite server-side identity fields already available from the Kubernetes API. The code path does not validate that the decoded configuration corresponds to the actual Deployment object and does not reject the sentinel value "null".

Attack Vector

Exploitation requires network access to the Kubernetes API and privileges sufficient to create or update Deployments in at least one namespace. The attacker submits a Deployment manifest that sets metadata.labels["openshift.io/encoded-deployment-config"] to the string "null". RHACS ingests the object, clears the identity fields, and skips or misattributes policy checks. No code execution against RHACS itself is required, and no user interaction is needed.

The vulnerability manifests during RHACS Sensor-to-Central deployment processing. Refer to the Red Hat CVE-2026-10079 Advisory and Red Hat Bug Report #2483158 for vendor-provided technical detail.

Detection Methods for CVE-2026-10079

Indicators of Compromise

Deployments carrying the label openshift.io/encoded-deployment-config with value "null" or otherwise malformed content.
RHACS Central deployment records with empty uid, empty name, empty labels, and namespace forced to default.
Kubernetes audit log entries showing Deployment create or update requests that inject the openshift.io/encoded-deployment-config label.
Gaps in RHACS violation history for workloads that should have triggered deploy-time policies.

Detection Strategies

Audit all Deployments across clusters for the openshift.io/encoded-deployment-config label and flag any value that is not a valid encoded config.
Correlate the Kubernetes API server audit log with RHACS Central deployment inventory to identify workloads present in the cluster but missing or misidentified in RHACS.
Alert on RHACS deployment records where core identity fields are empty while the underlying Kubernetes object has populated metadata.

Monitoring Recommendations

Forward Kubernetes API audit events and RHACS Central logs to a centralized data lake for correlation.
Monitor RBAC grants that allow create or update on deployments.apps and review anomalous label usage.
Track violation-reporting volume per cluster and investigate sudden drops that could indicate identity-metadata manipulation.

How to Mitigate CVE-2026-10079

Immediate Actions Required

Apply the Red Hat security update for RHACS as soon as it is available for your channel. Track status through the Red Hat CVE-2026-10079 Advisory.
Restrict Deployment create and update permissions to trusted service accounts and users using least-privilege RBAC.
Deploy an admission controller policy that rejects Deployments carrying the openshift.io/encoded-deployment-config label from unauthorized principals.
Audit existing Deployments in every cluster for the presence of the label and remediate any workloads that set it to "null".

Patch Information

Red Hat tracks remediation under the Red Hat CVE-2026-10079 Advisory and Bugzilla #2483158. Consult these references for fixed RHACS versions and errata identifiers applicable to your subscription channel.

Workarounds

Enforce an OPA Gatekeeper or Kyverno policy that blocks user-supplied values for the openshift.io/encoded-deployment-config label.
Limit who can set annotations and labels on Deployments through RBAC and validating admission webhooks until the patch is applied.
Increase logging verbosity on RHACS Sensor to capture ingestion of malformed deployment configuration data and review regularly.

bash

# Example Kyverno policy to block the abusable label
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-encoded-deployment-config-label
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-encoded-deployment-config
      match:
        any:
          - resources:
              kinds:
                - Deployment
      validate:
        message: "Setting openshift.io/encoded-deployment-config is not permitted."
        pattern:
          metadata:
            =(labels):
              X(openshift.io/encoded-deployment-config): "null"