CVE-2026-70496 & CVE-2026-66794: Privilege Escalation in Red Hat ACM Hits CVSS 9.9
Do Son 
TL;DR
Red Hat disclosed three high-severity flaws in its Advanced Cluster Management and Multicluster Engine for Kubernetes. The worst, CVE-2026-70496, scores 9.9 and enables Kubernetes privilege escalation to cluster-admin. Red Hat reports no known exploitation in the wild.
- Product: Red Hat (2 products)
- Vulnerabilities: 3 flaws (CVE-2026-70496, CVE-2026-66794, CVE-2026-71470)
- Highest severity: 9.9 (Critical · CVSSv3)
- Worst impact: Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-70496 | 9.9 | CWE-250 | — | Not exploited |
| CVE-2026-66794 | 9.3 | CWE-918 | — | Not exploited |
| CVE-2026-71470 | 9.1 | CWE-913 | — | Not exploited |
Why It Matters
Advanced Cluster Management governs fleets of Kubernetes clusters. A flaw there can therefore spread across every managed cluster. These bugs open paths to Kubernetes privilege escalation and full cluster takeover.
Two flaws need only low or scoped privileges to start. One needs no authentication at all. Together, they threaten secrets, workloads, and nodes.
How the Attacks Work
Each flaw abuses a different weak spot in the platform. The mechanisms differ, yet the impact converges on cluster control.
CVE-2026-70496 (CVSS 9.9)
The search-v2-operator ClusterRole holds cluster-admin-level rights. It can impersonate entities, write RBAC, approve CSRs, and manage ManifestWork. A low-privileged attacker could abuse this for Kubernetes privilege escalation, as Red Hat notes in its advisory for CVE-2026-70496.
CVE-2026-66794 (CVSS 9.3)
The cluster-proxy-addon in Multicluster Engine exposes a user-facing route. That route skips authentication and authorization checks. An unauthenticated attacker can bend URL path segments to proxy requests to internal services. Red Hat describes this SSRF path in the advisory for CVE-2026-66794.
CVE-2026-71470 (CVSS 9.1)
A Custom Resource editor can tamper with Search CR fields. Unvalidated input lets an attacker swap the container image or mount secrets. This escalates privileges to a full cluster compromise, per the advisory for CVE-2026-71470.
Affected Products
The flaws affect Red Hat Advanced Cluster Management and Multicluster Engine for Kubernetes. Red Hat does not publish install-count estimates for exposed clusters.
Patch and Mitigation Steps
Apply Red Hat updates for ACM and Multicluster Engine as they ship. Restrict Search CR edit rights through RBAC. Limit the cluster-proxy-addon route to trusted networks with firewall rules.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
