CVE-2026-10090: Privilege Defined With Unsafe Actions in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability exists in the Application Subscription controller (multicluster-operators-subscription) of Red Hat ACM for Kubernetes. A user with namespace-scoped 'edit' privileges can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The controller fetches and applies the Helm chart contents with elevated privileges without verifying if the user holds the 'open-cluster-management:subscription-admin' role and without restricting resources to the subscription namespace. This allows an attacker to include cluster-scoped resources, such as a ClusterRoleBinding that grants their ServiceAccount cluster-admin privileges, resulting in full cluster-admin privilege escalation.

Successful exploitation results in full cluster-admin privilege escalation, allowing an attacker with limited namespace-scoped 'edit' privileges to gain unrestricted control over the entire Kubernetes cluster managed by Red Hat ACM. This breaks the intended access control model and can lead to complete compromise of cluster resources and security.

Red Hat has released security updates addressing this vulnerability in later versions of Red Hat Advanced Cluster Management for Kubernetes. Users should apply the official security updates as documented in Red Hat advisory RHSA-2026:60387 and RHSA-2026:60386. Before applying updates, ensure all previously released errata relevant to your system are applied. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update procedures. Patch status is confirmed as fixed in versions later than 2.11, including 2.17.1. No workaround or temporary fix is indicated; applying the official update is required.