Privilege Escalation in multicloud-operators-subscription

A critical vulnerability, tracked as CVE-2026-67567, has been identified in the multicloud-operators-subscription component. The flaw stems from improper validation within the HelmRelease controller, which processes Helm chart templates using elevated ServiceAccount privileges. Tenants who possess the permission to create HelmRelease custom resources (CRs) can manipulate these templates to trigger the deployment of arbitrary resources across the entire Kubernetes cluster. This vulnerability enables a restricted tenant to break out of their intended namespace or security boundary, leading to a full compromise of cluster-wide security. Organizations using this component in a multitenant environment are at high risk, as the controller acts as a privileged proxy for untrusted user inputs.

Impact

Successful exploitation allows a tenant-level user to escalate their privileges to match those of the cluster-wide HelmRelease controller. This can result in unauthorized modification, creation, or deletion of any Kubernetes resource, leading to full cluster takeover, data exfiltration, or persistence. This vulnerability primarily affects enterprise environments deploying multicloud-operators-subscription within Kubernetes-based multitenancy architectures.

Recommendation

• Identify and audit all existing HelmRelease custom resources for anomalous template structures or unexpected resource definitions.
• Review RBAC policies to restrict the ability to create or modify HelmRelease custom resources to trusted administrative users only.
• Apply the vendor-provided patch or update to the latest version of multicloud-operators-subscription immediately.
• Monitor Kubernetes API audit logs for unauthorized or suspicious HelmRelease creation events originating from non-administrative service accounts or tenant users.