Auth bypass in Red Hat Multicluster Global Hub
CVE-2026-66792
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
Frequently asked questions
- What is CVE-2026-66792?
- CVE-2026-66792 is a critical-severity vulnerability in Red Hat Multicluster Global Hub, classified under Incorrect Authorization. CVSS score: 9.9/10. Published 2026-08-17.
- How severe is CVE-2026-66792?
- Critical severity. CVSS v3 base score is 9.9 out of 10.