CVE-2026-66792: Multicloud Operators Privilege Escalation

CVE-2026-66792 Overview

CVE-2026-66792 is a privilege escalation vulnerability in the multicloud-operators-subscription component, a controller used in multi-cluster Kubernetes environments to deliver application resources to managed clusters. A user with permission to create a Subscription on a managed cluster can supply crafted annotations that cause the controller to deploy resources into arbitrary namespaces using its Service Account credentials. The flaw is classified as improper authorization [CWE-863].

Critical Impact
Successful exploitation allows a low-privileged managed-cluster user to deploy resources across any namespace with the controller Service Account's elevated permissions, resulting in unauthorized access and control over cluster resources.

Affected Products

multicloud-operators-subscription controller (Red Hat Advanced Cluster Management / Open Cluster Management)
Managed clusters running the subscription controller Service Account
Deployments referenced in the Red Hat security advisory

Discovery Timeline

2026-08-17 - CVE-2026-66792 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66792

Vulnerability Analysis

The multicloud-operators-subscription component reconciles Subscription custom resources and deploys the referenced application resources onto managed clusters. The controller runs with a Service Account that carries broad cluster-scoped permissions so it can create, update, and delete resources across namespaces.

The controller processes user-supplied annotations on a Subscription object without adequately validating whether the requesting user has permission to act on the target namespace. As a result, the controller performs privileged operations on behalf of a lower-privileged caller. This is a canonical improper authorization pattern [CWE-863], where the trust boundary between the tenant and the controller collapses.

Root Cause

The root cause is missing authorization checks in the annotation-processing path of the Subscription reconciler. The controller treats annotations as trusted directives rather than as user-controlled input requiring server-side authorization. Because the controller acts under its own Service Account, any annotation-driven deployment inherits the controller's permissions instead of the submitter's.

Attack Vector

An authenticated user on a managed cluster who can create Subscription resources crafts a Subscription with specific annotations that redirect resource deployment to a namespace the user does not control. The controller reconciles the object and creates arbitrary Kubernetes resources, such as Deployments, RoleBindings, or Secrets, in that namespace. The attacker uses this primitive to plant workloads, bind cluster roles to attacker-controlled identities, or read protected data. See the Red Hat CVE-2026-66792 Advisory and Red Hat Bug Report #2507537 for vendor technical details.

No public proof-of-concept exploit code is available at this time. The vulnerability mechanism is described in prose because no verified exploitation code has been published.

Detection Methods for CVE-2026-66792

Indicators of Compromise

Subscription custom resources created by non-administrative users that carry annotations targeting namespaces outside the submitter's normal scope.
Resources such as Deployments, RoleBindings, or Secrets created in sensitive namespaces where the owner reference points to a Subscription object.
Kubernetes audit log entries showing the subscription controller Service Account writing to namespaces the submitting user cannot access directly.

Detection Strategies

Enable Kubernetes API server audit logging at the RequestResponse level for Subscription resources and correlate create/update events with downstream resource creation by the controller Service Account.
Alert on any Subscription object whose annotations reference namespaces that do not match the requesting user's role bindings.
Baseline the namespaces the subscription controller normally writes to, and flag deviations.

Monitoring Recommendations

Forward Kubernetes audit logs and controller logs to a centralized analytics platform for correlation across the managed fleet.
Track creation of ClusterRoleBinding and RoleBinding resources originating from the subscription controller Service Account.
Review changes to Subscription annotations as part of admission control review.

How to Mitigate CVE-2026-66792

Immediate Actions Required

Apply the fixed version of multicloud-operators-subscription as published in the Red Hat CVE-2026-66792 Advisory.
Restrict create and update permissions on Subscription resources to trusted principals only, and remove this permission from general tenant roles.
Audit existing Subscription objects for unexpected annotations or cross-namespace targets and remove any suspicious resources deployed by the controller.

Patch Information

Refer to the Red Hat CVE-2026-66792 Advisory and Red Hat Bug Report #2507537 for fixed component versions and product-specific update instructions. Update all managed clusters running the vulnerable controller.

Workarounds

Use an admission controller such as OPA Gatekeeper or Kyverno to reject Subscription resources whose annotations reference namespaces the submitter cannot access.
Reduce the controller Service Account's permissions using namespace-scoped RoleBindings where feasible, limiting the blast radius of the escalation.
Temporarily disable creation of Subscription resources for non-administrative users until the patch is applied.

bash

# Example Kyverno policy: block Subscriptions from non-admin users until patched
kubectl apply -f - <<EOF
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-subscription-creation
spec:
  validationFailureAction: Enforce
  rules:
    - name: block-non-admin-subscriptions
      match:
        any:
          - resources:
              kinds:
                - apps.open-cluster-management.io/Subscription
      exclude:
        any:
          - clusterRoles:
              - cluster-admin
      validate:
        message: "Subscription creation is restricted pending CVE-2026-66792 remediation."
        deny: {}
EOF