CVE-2026-10090
A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.
CSIRTS triage
- What
- A namespace edit user can deploy cluster-scoped ClusterRoleBinding and escalate privileges to cluster-admin.
- Who is affected
- Red Hat Advanced Cluster Management for Kubernetes 2 deployments where users have namespace edit permissions.
- Urgency
- High priority; privilege escalation to cluster-admin enables full cluster compromise.
- Action
- Apply Red Hat security updates for Red Hat Advanced Cluster Management for Kubernetes 2 as they become available.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-10090
Get an email if CVE-2026-10090 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
Advisory coverage (3)
- unknownRed Hat security advisory (AV26-803)cccs · 2026-08-11
- unknownBulletin de sécurité Red Hat (AV26-803)cccs · 2026-08-11
- criticalCVE-2026-10090: A flaw was found in the Application Subscription controller (multicluster-operators-subscripti…nvd · 2026-08-05
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-10090)