Red Hat ACM Privilege Escalation Flaw Grants Cluster-Admin Access
A critical privilege escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes (ACM) allows low-privilege users to gain full cluster-admin control.
Red Hat has disclosed a critical privilege escalation flaw, tracked as CVE-2026-10090, affecting the Application Subscription controller in Red Hat Advanced Cluster Management for Kubernetes (ACM). Rated Important with a CVSS score of 9.9, the vulnerability allows a user with only namespace-scoped "edit" permissions on an ACM hub to escalate all the way to full cluster-admin rights, effectively handing low-privilege insiders control over the entire managed cluster fleet.
The bug resides in the multicluster-operators-subscription component, which powers ACM's Application Subscription feature. According to Red Hat's advisory, a user holding basic edit privileges in a hub namespace can create a Channel resource pointing to a Helm repository they personally control, then link it to a Subscription resource that references that channel. The app-subscription controller processes this request using its own elevated service account authority rather than the requester's actual permissions.
Critically, the controller never checks whether the person creating the subscription actually holds the "open-cluster-management:subscription-admin" role, and it fails to restrict the resources being deployed to the subscription's own namespace. Because of this missing authorization check, an attacker can embed cluster-scoped objects inside their malicious Helm chart, most notably a ClusterRoleBinding that binds their own ServiceAccount to the built-in "cluster-admin" ClusterRole.
Once the controller applies the chart, that binding is created with full privileges, and the attacker instantly becomes a cluster administrator. Red Hat classifies the underlying weakness as CWE-267, Privilege Defined With Unsafe Actions, and the flaw is documented under Bugzilla entry 2483292.
This vulnerability is particularly severe because it directly contradicts ACM's own documented security model, which states that non-subscription-admin users should only ever be able to deploy resources into their own subscription namespace. Organizations relying on ACM to enforce multi-tenant separation across hub-managed clusters could unknowingly be exposing every managed cluster to takeover by any user who merely has edit-level access to a single namespace, a permission level often granted broadly to developers and application teams.
Given that ACM is widely deployed in enterprise and government environments to centrally govern fleets of OpenShift and Kubernetes clusters, successful exploitation could cascade far beyond a single namespace, granting attackers the ability to read secrets, modify workloads, or pivot into every cluster registered with that hub.
Red Hat's advisory notes that no dedicated mitigation currently meets the company's criteria for ease of deployment, applicability across installations, or long-term stability. The affected package is identified as rhacm2/multicluster-operators-subscription-rhel9 under Red Hat Advanced Cluster Management for Kubernetes 2, and its current state is listed as "Affected" with no errata yet issued.
Until an official patch or errata is released, security teams should audit who holds namespace-scoped edit access on ACM hub namespaces, closely monitor Channel and Subscription resource creation for unauthorized Helm repository references, and restrict subscription-admin privileges strictly to trusted operators. Enabling admission control policies that block cluster-scoped resources from being deployed via application subscriptions is also advisable as an interim compensating control while Red Hat finalizes a fix.