CVE-2026-66792: Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-17 · updated 2026-09-29
Weakness: CWE-863

Description

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

Affected products

Red Hat Multicluster Global Hub 1.4.9: all versions — fixed in 1788355417, 1788355439, 1788355599
Red Hat Multicluster Global Hub 1.5.8: all versions — fixed in 1789478830, 1789515288, 1789515408
Red Hat Multicluster Global Hub 1.6.6: all versions — fixed in 1790085268, 1790085494, 1790086176
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Advanced Cluster Management for Kubernetes 2.11: all versions — fixed in 1787262214, 1787263584
Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1787259284, 1787263693
Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1786976940, 1787170830
Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1787238598, 1787240030
Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1787242135, 1787242321
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787242108, 1787242131

How to fix

Upgrade to a fixed version: Red Hat Multicluster Global Hub 1.4.9 1788355417, 1788355439, 1788355599; Red Hat Multicluster Global Hub 1.5.8 1789478830, 1789515288, 1789515408; Red Hat Multicluster Global Hub 1.6.6 1790085268, 1790085494, 1790086176; Red Hat Advanced Cluster Management for Kubernetes 2.11 1787262214, 1787263584; Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259284, 1787263693; Red Hat Advanced Cluster Management for Kubernetes 2.14 1786976940, 1787170830; Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238598, 1787240030; Red Hat Advanced Cluster Management for Kubernetes 2.16 1787242135, 1787242321; Red Hat Advanced Cluster Management for Kubernetes 2.17 1787242108, 1787242131. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66792 or the next vulnerability affects your stack