CVE-2026-67567: Critical Privilege Escalation in Multicloud Operators Subscription

Executive Summary

A critical privilege escalation vulnerability (CVE-2026-67567, CVSS 9.9) has been identified in the multicloud-operators-subscription component used in Red Hat OpenShift environments. The flaw allows a tenant with the ability to create HelmRelease custom resources (CRs) to bypass existing security controls and cause the system's HelmRelease controller to process malicious Helm chart templates using its own elevated service account privileges.

Successful exploitation enables a tenant to escape their intended security boundary and execute workloads or read secrets outside their authorized namespace scope.

Vulnerability Details

Root Cause

The multicloud-operators-subscription HelmRelease controller processes Helm chart templates supplied via tenant-controlled HelmRelease CRs. The controller fails to adequately restrict what resources tenants can template or which namespaces those templates can target. Because the controller runs with elevated cluster permissions, a crafted HelmRelease CR can instruct it to deploy arbitrary resources — including ClusterRoleBindings, secret-reading pods, or workloads targeting system namespaces — effectively granting the tenant cluster-admin-equivalent capabilities.

The vulnerability exists because the system:

1. Does not sufficiently validate the contents of tenant-supplied Helm chart templates before rendering
2. Processes all HelmRelease CRs using the controller's own elevated service account rather than impersonating the tenant's identity
3. Lacks namespace scoping enforcement at the template evaluation stage

Impact

An authenticated tenant (low-privilege user with HelmRelease CR create rights) can:

• Escalate privileges to cluster-admin level by creating privileged ClusterRoleBinding resources
• Access secrets across all namespaces, including credentials, certificates, and API tokens
• Deploy unauthorized workloads in restricted namespaces including kube-system and openshift-*
• Exfiltrate data from other tenants in shared multi-tenant OpenShift clusters
• Persist malicious configurations that survive pod restarts

The CVSS 9.9 score reflects the near-total cluster compromise achievable from a relatively low-privilege starting position.

Affected Systems

Any OpenShift or Kubernetes deployment that:

• Uses the multicloud-operators-subscription component
• Permits tenant users to create or modify HelmRelease custom resources
• Runs the HelmRelease controller with cluster-level service account permissions

Multi-tenant environments are at the highest risk, as the vulnerability specifically undermines tenant isolation guarantees.

Remediation

1. Apply the vendor patch as soon as it becomes available. Monitor Red Hat Security Advisories for the official fix targeting this CVE.
2. Restrict HelmRelease CR creation to only highly-trusted administrators or service accounts until a patch is applied.
3. Audit existing HelmRelease CRs for suspicious or unexpected resource definitions, particularly those referencing cluster-scoped resources or non-tenant namespaces.
4. Review RBAC policies to minimize the number of users and service accounts with HelmRelease create/update rights.
5. Enable audit logging on HelmRelease resource creation/modification events in the Kubernetes API server to detect exploitation attempts.

Detection Guidance

Security teams should watch for:

• HelmRelease CRs containing ClusterRoleBinding, ClusterRole, or cross-namespace resource templates
• Unexpected resource creation in kube-system, openshift-*, or other restricted namespaces attributable to the HelmRelease controller service account
• Pods launched with hostPID, hostNetwork, or privileged security contexts originating from HelmRelease reconciliation
• Access to secrets outside the tenant's designated namespace by the controller service account

Kubernetes audit logs querying the multicloud-operators-subscription service account are your primary detection signal.

References

• NVD — CVE-2026-67567
• Red Hat Security Advisories