CVE-2026-110744: Improper Privilege Management in Red Hat Multicluster Global Hub

The vulnerability in the multicluster-global-hub-operator-bundle arises from its configuration with excessively permissive role-based access control (RBAC) settings. These settings permit cluster-wide impersonation without restrictions, allowing an attacker who compromises the operator or obtains its service account credentials to escalate privileges to full cluster administrator level. The CVSS 3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker who successfully exploits this vulnerability can achieve privilege escalation, gaining full administrative control over the affected Kubernetes cluster. This can lead to complete compromise of cluster resources, data, and operations.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-110744 for current remediation guidance. Until an official fix is available, restrict access to the operator and its service account credentials to trusted personnel only and monitor for any suspicious activity related to impersonation or privilege escalation attempts.