Skip to content
Advisories.
Red HatCVE-2026-66792

Red Hat multicloud-operators-subscription: privilege escalation

Critical9.9CVE-2026-66792 · Published Aug 17, 2026 · updated Sep 24, 2026

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

Red Hat advisory

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Red Hat advisories

All Red Hat
Advisory
Red Hat managedcluster-import-controller: privilege escalation
Critical9.9Aug 17
Red Hat Advanced Cluster Management: improper privilege management
High8.8Aug 17
Red Hat acm-search-v2-rhel9. This vulnerability: code execution
Critical9.1Aug 17
Red Hat fakefish: missing authentication
Critical9.3Aug 17
Red Hat fakefish: command injection
High7.7Aug 17
Red Hat OpenShift AI (RHOAI): remote code execution
High7.9Aug 17

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.