CVE-2026-10079 is a vulnerability in Red Hat Advanced Cluster Security for Kubernetes (RHACS) where ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label when processing Kubernetes Deployments. If a user with deployment creation permissions sets this label to "null", ACS treats the workload as having empty UID, name, labels, and assigns it to the "default" namespace. This results in bypassing deploy-time policy detection and enforcement visibility, prevents correct persistence in Central, and breaks violation reporting and compliance correlation for the affected deployment.

The vulnerability allows an attacker with permission to create Kubernetes Deployments to evade deploy-time policy detection and enforcement in RHACS. This leads to incomplete visibility and reporting of policy violations, potentially allowing unauthorized or non-compliant workloads to run without detection. The flaw affects confidentiality and integrity aspects by hiding workload identity and policy violations, but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No explicit patch or fix information is provided in the advisory content. Until a fix is available, restrict permissions to create Deployments to trusted users only and monitor for anomalous use of the openshift.io/encoded-deployment-config label. Follow updates from Red Hat's official advisory page for CVE-2026-10079 for remediation instructions.