CVE-2026-10090: Red Hat ACM Privilege Escalation Flaw

CVE-2026-10090 Overview

CVE-2026-10090 is a privilege escalation flaw in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user holding namespace-scoped edit privileges on an ACM hub namespace can create a Channel resource pointing to an attacker-controlled Helm repository along with a Subscription resource that references it. The controller then fetches and applies the Helm chart contents using its own elevated authority. It does not verify whether the requester holds the open-cluster-management:subscription-admin role, and it does not restrict applied resources to the subscription namespace. Successful exploitation yields full cluster-admin privileges on the ACM hub.

Critical Impact
A namespace-scoped edit user can escalate to cluster-admin on the ACM hub by delivering cluster-scoped resources through a Helm chart applied by the subscription controller.

Affected Products

Red Hat Advanced Cluster Management for Kubernetes (ACM)
multicluster-operators-subscription Application Subscription controller
ACM hub clusters exposing namespaced edit roles to untrusted users

Discovery Timeline

2026-08-05 - CVE-2026-10090 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-10090

Vulnerability Analysis

The flaw sits in ACM's Application Subscription workflow, which is designed to let cluster operators deliver workloads through GitOps-style Channel and Subscription resources. The controller reconciles these objects with the service account permissions of the controller itself rather than the requesting user. Red Hat's documentation states that non-subscription-admin users should have resources deployed only into the subscription's own namespace. The controller implementation does not enforce that boundary. It also fails to check that the subscription creator holds the open-cluster-management:subscription-admin ClusterRole before applying chart contents. A user with only namespace-level edit rights can therefore cause the controller to apply arbitrary cluster-scoped Kubernetes objects on their behalf. This is tracked under [CWE-267: Privilege Defined With Unsafe Actions].

Root Cause

The root cause is a missing authorization check combined with a scope-enforcement gap. The subscription reconciler treats every accepted Subscription as if it were created by a privileged subscription-admin. It also does not filter the manifests rendered from the referenced Helm chart to remove cluster-scoped kinds or reject objects targeting namespaces outside the subscription. The controller's own high-privilege service account then becomes a confused deputy that applies whatever the attacker packaged.

Attack Vector

An authenticated user with edit rights in an ACM hub namespace hosts a Helm chart on a repository they control. The chart contains cluster-scoped manifests such as a ClusterRoleBinding that grants cluster-admin to a ServiceAccount owned by the attacker. The attacker then creates a Channel object pointing to the repository and a Subscription object that references the channel. The app-subscription controller pulls the chart, renders it, and applies every manifest using its elevated identity. The attacker authenticates as the newly privileged ServiceAccount and holds full control over the ACM hub cluster, including all managed cluster credentials it can reach.

No verified public exploit code is available. Refer to the Red Hat CVE-2026-10090 Advisory and Red Hat Bug #2483292 Details for authoritative technical detail.

Detection Methods for CVE-2026-10090

Indicators of Compromise

Creation of Channel resources in hub namespaces that reference external Helm repositories not on an approved allowlist.
Subscription objects authored by identities that do not hold the open-cluster-management:subscription-admin ClusterRole.
New ClusterRoleBinding or ClusterRole objects whose subjects reference ServiceAccounts in tenant or application namespaces.
Audit log entries showing the app-subscription controller service account applying cluster-scoped resources shortly after a Subscription reconcile event.

Detection Strategies

Enable Kubernetes API server audit logging on the ACM hub and alert on create and update verbs against clusterrolebindings.rbac.authorization.k8s.io performed by the subscription controller service account.
Correlate Channel and Subscription creation events with subsequent cluster-scoped resource writes attributed to multicluster-operators-subscription.
Baseline the set of Helm repository URLs referenced by Channel objects and alert on new or externally hosted entries.

Monitoring Recommendations

Forward Kubernetes and ACM controller audit logs to a centralized SIEM or data lake for retrospective search.
Monitor RBAC changes on the hub cluster continuously, with priority on any binding that grants cluster-admin.
Review the membership of the open-cluster-management:subscription-admin ClusterRoleBinding on a recurring schedule and alert on drift.

How to Mitigate CVE-2026-10090

Immediate Actions Required

Apply the Red Hat security update for multicluster-operators-subscription as soon as it is available for your ACM release channel.
Audit all existing Channel and Subscription objects on the ACM hub and remove those authored by users who are not subscription-admin.
Remove or tightly scope namespace-level edit rights on ACM hub namespaces for users who do not require Application Subscription functionality.

Patch Information

Red Hat is tracking the fix under Red Hat Bug #2483292. Consult the Red Hat CVE-2026-10090 Advisory for the list of fixed ACM versions and channel-specific errata as they are released.

Workarounds

Restrict who can create Channel and Subscription resources on the ACM hub by removing broad edit permissions from shared namespaces.
Use an admission controller such as OPA Gatekeeper or Kyverno to reject Subscription objects whose creators are not members of open-cluster-management:subscription-admin.
Block Helm chart manifests containing cluster-scoped kinds (for example ClusterRole, ClusterRoleBinding) via admission policy on the hub cluster.
Constrain Channel resources to an allowlist of trusted Helm repository URLs.

bash

# Example Kyverno policy: forbid non-subscription-admins from creating Subscriptions
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-acm-subscriptions
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-subscription-admin
      match:
        any:
          - resources:
              kinds:
                - apps.open-cluster-management.io/v1/Subscription
      context:
        - name: userGroups
          variable:
            jmesPath: "request.userInfo.groups"
      validate:
        message: "Only members of open-cluster-management:subscription-admin may create Subscriptions."
        deny:
          conditions:
            all:
              - key: "open-cluster-management:subscription-admin"
                operator: NotIn
                value: "{{ userGroups }}"