CVE-2026-66792 is a critical privilege escalation vulnerability in the multicloud-operators-subscription component. A user with privileges on a managed cluster can craft a Subscription resource with specific annotations that bypass intended authorization checks (CWE-863). This allows the attacker to deploy resources across multiple namespaces with the elevated permissions of the controller's Service Account, effectively granting cluster-admin level access. The vulnerability impacts Red Hat Advanced Cluster Management for Kubernetes and related products. Red Hat has not yet released an official patch or fix, citing challenges in ease of use, applicability, and stability of available mitigations.

Successful exploitation results in privilege escalation to cluster-admin level, enabling unauthorized deployment of resources across namespaces. This can lead to unauthorized access, modification, and control over cluster resources, including executing unauthorized code and causing denial of service. The vulnerability affects confidentiality, integrity, and availability of the managed Kubernetes cluster environment.

Currently, no official fix or patch meeting Red Hat's standards is available. Red Hat advises monitoring their advisory for updates. Customers should consider upgrading to supported product versions once fixes are released. No specific mitigations are provided that fully address the issue at this time.