CVE-2026-10090: Red Hat ACM Helm Channel Privilege Escalation (CVSS 9.9)

Executive Summary

A critical privilege escalation vulnerability (CVE-2026-10090, CVSS 9.9) has been disclosed in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped edit privileges in an ACM hub namespace can exploit this flaw to gain cluster-admin level access — the highest privilege level in Kubernetes — by creating a Channel resource that points to a malicious Helm repository they control.

Vulnerability Details

The Application Subscription controller in Red Hat ACM processes Channel resources that reference external Helm repositories. When the controller fetches and processes Helm charts from a Channel, it does so under a highly privileged service account without properly restricting what a channel owner can direct it to consume.

A user with only namespace-scoped edit permissions in an ACM hub namespace — a relatively low-privilege role — can create a Channel resource pointing to a Helm repository they own and control. By crafting the Helm chart contents or repository responses to exploit the controller's processing context, the attacker can escalate to cluster-admin privileges across the entire Kubernetes cluster managed by ACM.

Attack Chain

1. Attacker obtains namespace-scoped "edit" access to an ACM hub namespace
   (low initial privilege — may be a legitimate tenant or a compromised account)
 
2. Attacker creates a Channel resource pointing to an attacker-controlled Helm repo
 
3. The multicluster-operators-subscription controller fetches and processes
   Helm charts from the attacker's repository under its privileged service account
 
4. Attacker's malicious Helm chart triggers cluster-admin-level operations
   or exfiltrates the controller's service account token
 
5. Attacker achieves cluster-admin access across the ACM-managed cluster fleet

Impact

With CVSS 9.9, this vulnerability is rated nearly perfect in severity. The combination of low required privileges, network accessibility, and cluster-admin outcome makes this a high-priority remediation target for any organization running Red Hat ACM.

Affected Products

Check your Red Hat ACM version via:

# Check ACM operator version
oc get csv -n open-cluster-management | grep advanced-cluster-management
 
# Check subscription controller version
oc get deployment multicluster-operators-subscription -n open-cluster-management -o jsonpath='{.spec.template.spec.containers[0].image}'

Remediation

Step 1: Apply Red Hat Security Patch

Red Hat has released a fix. Apply the latest ACM update immediately:

# Update ACM via the OperatorHub/OLM
oc patch subscription advanced-cluster-management \
  -n open-cluster-management \
  --type merge \
  -p '{"spec":{"channel":"release-2.x"}}'
 
# Or via the OpenShift web console:
# Operators > Installed Operators > Advanced Cluster Management > Update

Refer to the Red Hat Security Advisory linked below for the specific fixed versions.

Step 2: Audit Existing Channel Resources

Identify all Channel resources in your ACM hub namespaces and verify their source repositories are trusted:

# List all Channel resources across namespaces
oc get channels -A -o wide
 
# Inspect each channel's spec.pathname (the repo URL)
oc get channels -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.pathname}{"\n"}{end}'

Flag any channels pointing to external or unexpected Helm repositories.

Step 3: Review RBAC — Restrict Namespace Edit Access

Until patching is complete, limit who has edit or higher permissions in ACM hub namespaces:

# Audit RoleBindings in ACM hub namespace
oc get rolebindings -n open-cluster-management -o wide
 
# Review ClusterRoleBindings that could grant ACM namespace access
oc get clusterrolebindings -o wide | grep -E "edit|admin"

Step 4: Monitor for Exploitation Signs

Watch for anomalous actions by the subscription controller's service account:

# Audit API server logs for high-privilege actions by the subscription SA
# In OpenShift:
oc adm top pods -n open-cluster-management
 
# Check audit logs for ClusterRoleBinding creation or secret access
# by the multicluster-operators-subscription service account

Detection Indicators

Mitigation Workaround (If Immediate Patching Is Blocked)

1. Restrict edit RBAC in ACM hub namespaces to only fully trusted identities
2. Audit and remove any Channel resources with external or untrusted spec.pathname URLs
3. Monitor audit logs closely for the subscription controller's service account activity
4. Network-restrict the subscription controller's outbound access to only approved Helm repository hosts using NetworkPolicy

References

• NVD — CVE-2026-10090
• Red Hat Security Advisory
• Red Hat ACM Documentation

Related Reading

• CVE-2026-10059: Multicluster Engine ClusterCurator Token Escalation
• CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited