Red Hat security advisory (AV26-803)

unknownCVE-2026-10090

Serial Number: AV26-803 Date: August 11, 2026 As of August 5, 2026, Red Hat is affected by a vulnerability in the following product: Red Hat Advanced Cluster Management for Kubernetes 2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CVE-2026-10090 - Red Hat Customer Portal 2483292 – (CVE-2026-10090) CVE-2026-10090 multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped ClusterRoleBinding and become cluster-admin via Application Subscription Security Updates

CSIRTS triage

vendor: Red Hat product: Red Hat Advanced Cluster Management for Kubernetes Privilege escalationaffected: 2

What: A namespace edit user can deploy cluster-scoped ClusterRoleBinding and escalate privileges to cluster-admin.
Who is affected: Red Hat Advanced Cluster Management for Kubernetes 2 deployments where users have namespace edit permissions.
Urgency: High priority; privilege escalation to cluster-admin enables full cluster compromise.
Action: Apply Red Hat security updates for Red Hat Advanced Cluster Management for Kubernetes 2 as they become available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Red Hat Advanced Cluster Management for Kubernetes

Get an email when a new Red Hat Advanced Cluster Management for Kubernetes advisory drops — max one per day, one-click unsubscribe.

Details

Source: Canadian Centre for Cyber Security (CA · national-cert · site)
Severity: unknown
Published: 2026-08-11
Exploitation: Not in CISA KEV at last sync

Original advisory: https://cyber.gc.ca/en/alerts-advisories/security-bulletin-red-hat-av26-803

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-100900.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-10090	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.