Red Hat ACM: Subscription Controller Becomes Bridge for Total…

A vulnerability in Red Hat Advanced Cluster Management allows users with edit permissions on a single namespace to gain full cluster-admin privileges. No patch or mitigation meeting Red Hat's quality criteria is currently available.

On August 5, 2026, Red Hat published advisory CVE-2026-10090 for a flaw in the Application Subscription controller of Advanced Cluster Management for Kubernetes: a user with only namespace-scoped edit permissions can trigger an escalation to cluster-admin privileges via a malicious Helm chart. The severity is confirmed by a CVSS 9.9 score, but at the time of disclosure no patch or mitigation meeting Red Hat's quality criteria is available.

Key Takeaways

The vulnerable component is multicluster-operators-subscription, the controller that orchestrates Helm application deployments through ACM's Channel and Subscription resources.
The attack requires only namespace-scoped edit permissions: no cluster-level privileges or the subscription-admin role are needed.
The controller applies Helm resources with its own elevated authority, without verifying the Subscription creator's role and without restricting scope to the originating namespace.
No mitigation is available: the Red Hat advisory explicitly states that current options do not meet stability and applicability criteria.

The Mechanism: A "Confused Deputy" at the Heart of Multi-Cluster Automation

The vulnerability exploits a classic confused deputy pattern: a service with elevated privileges executes actions on behalf of a lower-privileged subject without adequately validating the request. In ACM's case, the attack flow documented by Red Hat proceeds through three stages.

First, the threat actor creates a Channel resource pointing to a Helm repository under their control. Second, they create a Subscription referencing that Channel. Third, the app-subscription controller — operating with elevated authority — automatically retrieves and applies the chart's contents.

The flaw lies in two specific missing controls: the controller does not verify whether the Subscription creator holds the open-cluster-management:subscription-admin role, as prescribed by ACM documentation; and does not restrict applied resources to the Subscription's namespace. This combination allows injection of cluster-scoped resources, including ClusterRoleBindings that grant the cluster-admin privilege to the attacker's ServiceAccount.

The CWE-267 classification (Privilege Defined With Unsafe Actions) confirms the nature of the defect: the controller's privileges are exercised without the authorization checks necessary to prevent abuse.

The Attack Vector: From Namespace Editor to Cluster Master

The full CVSS vector reported in the official advisory — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — summarizes the flaw's danger: network access, low attack complexity, minimal privileges required, no user interaction needed, impact on confidentiality, integrity, and availability, with scope extending beyond the vulnerable component (S:C).

For enterprise and government environments using ACM to orchestrate fleets of Kubernetes or OpenShift clusters, the stakes are structural. Kubernetes' multi-tenant security model assumes that namespace-level RBAC controls effectively isolate workloads: this vulnerability invalidates that assumption for all installations adopting the Application Subscription workflow.

The source gbhackers.com explicitly described the mechanism as a "confused deputy problem", highlighting how a legitimate automation function — automated Helm application deployment — becomes a vehicle for total perimeter compromise.

No Way Out: The Advisory Closes Every Option

One element distinguishing this disclosure is the total absence of mitigation. The Red Hat advisory does not indicate valid workarounds; indeed, the wording is unequivocal:

"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
— Red Hat Customer Portal, CVE-2026-10090 advisory

This statement, quoted verbatim from the primary source, means operators can neither apply a patch nor adopt simple countermeasures without compromising system functionality or stability. The implicit recommendation is that organizations must wait for an official update that meets Red Hat's quality criteria.

Bugzilla 2483292, cited by cybersecuritynews.com, tracks the issue internally but offers no additional operational guidance for end users.

The Researcher and Discovery Context

The vulnerability was identified by Christopher Lusk of North Echo Security Research, credited in the official Red Hat advisory. August 5, 2026 is the coordinated disclosure publication date; the dossier does not specify the exact initial report date or the vendor's responsible handling timeline.

The affected component, rhacm2/multicluster-operators-subscription-rhel9, belongs to the Red Hat Advanced Cluster Management for Kubernetes 2 product line. Sources do not indicate specific versions exempt from the problem beyond the generic major release indication.

What to Do Now

Given the absence of official patches and mitigations, documented actions focus on compensating controls and monitoring:

Audit namespace-scoped edit permissions: identify all users and ServiceAccounts holding this privilege on ACM hubs, assessing whether granularity can be reduced without operational impact.
Monitor Channel and Subscription resource creation: anomalous provisioning of Subscriptions pointing to non-corporate Helm repositories constitutes an indicator of potential exploitation.
Verify presence of unauthorized ClusterRoleBindings: particularly those associating user-namespace ServiceAccounts with the cluster-admin ClusterRole.
Review internal documentation on the subscription-admin role: ensure operational policies reflect the documented — but not enforced by the controller — requirement to hold that role for creating cluster-scoped Subscriptions.

The brief documents no specific corrective measures beyond these defensive lines; in particular, no recommendations emerge from Red Hat regarding network isolation, OPA/Gatekeeper policies, or Helm policy interventions.

Why This Flaw Recalibrates Multi-Cluster Risk

Kubernetes fleet governance has built its security model on the separation between hub control and spoke workloads: the hub orchestrates, spokes execute, and RBAC ensures that those who define policy cannot necessarily compromise execution. CVE-2026-10090 demolishes this separation from the bottom up, allowing an actor with the most common role in development environments — the namespace editor — to scale to total control.

For organizations using ACM as a centralized governance layer, the message is that automation itself has become an attack surface. Until an official erratum arrives, security depends on the assumption that no account with edit on a namespace can be compromised or turn malicious: an assumption most enterprises cannot afford to accept.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references