Privilege Escalation in Red Hat Multicluster Global Hub

CVE-2026-66792 identifies a critical security flaw (CWE-863) within the multicloud-operators-subscription component used in Red Hat Multicluster Global Hub. The vulnerability stems from improper authorization checks when processing Subscription resources. An authenticated user with limited access on a managed cluster can submit a Subscription object containing specifically crafted metadata annotations. When processed by the controller, these annotations bypass standard permission checks, granting the attacker the elevated privileges associated with the controller's Service Account. Successful exploitation allows the attacker to manipulate or deploy resources across any namespace within the cluster, potentially leading to full cluster compromise. This issue affects Red Hat Multicluster Global Hub installations and requires immediate attention due to the high CVSS v3.1 score of 9.9.

Attack Chain

1. Attacker gains low-privileged access to a managed cluster environment.
2. Attacker crafts a Kubernetes Subscription resource definition.
3. Attacker injects malicious, specially crafted annotations into the Subscription resource metadata.
4. Attacker applies the crafted Subscription resource to the cluster API.
5. The multicloud-operators-subscription controller reconciles the malicious Subscription object.
6. The controller fails to validate the injected annotations, associating the operation with its own high-privilege Service Account.
7. Attacker gains the ability to create, modify, or delete resources in arbitrary namespaces.
8. Final objective achieved: Full cluster control or arbitrary resource deployment with elevated permissions.

Impact

Successful exploitation grants an attacker the ability to deploy resources into any namespace within a Kubernetes environment using the permissions of the component's Service Account. In production environments, this results in unauthorized access, data exfiltration, or complete compromise of cluster integrity and availability. Multiple components of the Red Hat Multicluster Global Hub are affected.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

• Identify and audit all existing Subscription resources within the cluster for suspicious or unexpected annotations.
• Apply the latest security patches provided by Red Hat for the Multicluster Global Hub via the Red Hat Customer Portal.
• Review Kubernetes audit logs for API calls creating or updating Subscription objects, focusing on requests originating from non-authorized service accounts.
• Implement Admission Controllers to enforce strict validation policies for Kubernetes resource annotations to prevent the submission of malformed or unauthorized data.