CVE-2026-66792 (CVSS 9.9): Red Hat ACM Flaw Allows Full Compromise of the Managed Cluster

TL;DR

Red Hat disclosed three critical flaws in its multicluster Kubernetes products. The most severe, CVE-2026-66792, scores a CVSS 9.9. It lets a privileged user on a managed cluster escalate to cluster-admin. That escalation enables full compromise of the managed cluster. No exploitation in the wild has been confirmed.

Why It Matters

These products manage fleets of Kubernetes clusters from a central hub. A single flaw can therefore ripple across many clusters. Each of these three bugs carries a critical rating.

The impact reaches cluster-admin, the highest level of control. As a result, an attacker can gain full compromise of the managed cluster or the hub. No public proof-of-concept exploit has been released so far.

How the Attacks Work

CVE-2026-66792 (CVSS 9.9)

This flaw sits in the multicloud-operators-subscription component. A user crafts a Subscription with specific annotations. The controller then deploys resources into any namespace using its own elevated Service Account. That bypass leads to full compromise of the managed cluster.

CVE-2026-66795 (CVSS 9.1)

This bug affects the managedcluster-import-controller. Its CSR auto-approval logic fails to inspect the signer name or decode the certificate request. Consequently, a malicious CSR from a spoke cluster can win admin credentials on the hub.

CVE-2026-71472 (CVSS 9.1)

This flaw lives in the ACM search component. A privileged user injects shell or SQL commands through an unvalidated WORK_MEM string. The code runs inside the privileged postgres pod. This report describes the mechanism only.

Affected Versions

The flaws affect Red Hat Advanced Cluster Management for Kubernetes and OpenShift Multicluster Engine. Red Hat lists the affected components as the subscription, import, and search operators.

Patch and Mitigation Steps

Apply Red Hat’s security errata as they become available. For the subscription flaw, Red Hat notes no mitigation currently meets its criteria, so patching is essential.

Until fixes land, tighten RBAC on managed and spoke clusters. You should also audit who can create Subscription, CSR, and Search resources. Monitor Red Hat’s advisories for each CVE and update promptly.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.