Privilege escalation in Red Hat Multicluster Engine For Kubernetes
CVE-2026-75924
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.
Vulnerability class: Privilege Escalation
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.
Affected products
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
Frequently asked questions
- What is CVE-2026-75924?
- CVE-2026-75924 is a high-severity vulnerability in Red Hat Multicluster Engine For Kubernetes, classified under Improper Privilege Management. CVSS score: 8.7/10. Published 2026-08-18.
- How severe is CVE-2026-75924?
- High severity. CVSS v3 base score is 8.7 out of 10.