Red Hat ACM hit by critical CVE that could lead to cluster-admin access

Red Hat disclosed CVE-2026-10090 on August 5th, 2026, a privilege escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes. The flaw carries a CVSS v3.1 score of 9.9 and could allow an authenticated user with edit permissions in a namespace to escalate privileges to cluster-admin. No official evidence currently confirms exploitation in the wild.

The issue deserves particular attention from enterprises operating Kubernetes or Red Hat OpenShift environments shared by multiple development teams, tenants, or business units. The primary concern is not unauthenticated remote compromise, but the possibility that a legitimate low-privilege account could be turned into an account with administrative control over the entire cluster.

What happened in Red Hat ACM?

CVE-2026-10090 affects the Application Subscription controller in Red Hat Advanced Cluster Management for Kubernetes, specifically the multicluster-operators-subscription component.

According to Red Hat Product Security, an authenticated user with edit permissions in a namespace on the ACM hub can create a Channel pointing to a Helm repository under the user's control. The user can then create a Subscription referencing that Channel.

As a result, an account initially restricted to edit privileges in a namespace could potentially gain administrative privileges across the entire cluster.

Red Hat ACM vulnerability CVE-2026-10090

Why is CVE-2026-10090 rated so highly?

Red Hat assigned CVE-2026-10090 a CVSS v3.1 score of 9.9 out of 10, placing it near the maximum severity level. The vulnerability has low attack complexity, can be exploited over a network, requires no user interaction, and only requires low privileges as a starting point.

Category	Details
CVE	CVE-2026-10090
Product	Red Hat Advanced Cluster Management for Kubernetes
Component	Application Subscription controller
Related package	multicluster-operators-subscription
Initial requirement	Authenticated account with edit privileges
Potential result	Privilege escalation to cluster-admin
CVSS v3.1	9.9
Vector	AV/AC/PR/UI/S/C/I/A
CWE	CWE-267 – Privilege Defined With Unsafe Actions

Is CVE-2026-10090 being exploited in the wild?

As of August 11, 2026, no authoritative source has confirmed active exploitation of CVE-2026-10090 in the wild.

Red Hat also states that no mitigation currently meets its criteria for widespread applicability, ease of deployment, and stability. Organizations should therefore continue monitoring Red Hat Product Security for patches, advisories, or remediation instructions applicable to their deployed versions.

Which organizations should pay particular attention?

The risk is especially relevant to organizations using Red Hat Advanced Cluster Management to operate Kubernetes or OpenShift environments shared by multiple user groups.

Enterprises should pay close attention when developers, application teams, external vendors, or tenants are granted edit permissions in namespaces on an ACM hub.

This is why vulnerability management should not stop at identifying a CVE. Organizations need to determine which assets are affected, evaluate whether exploitation is realistic in their own environment, perform remediation, and validate the result afterward

👉 IPSIP Vietnam discusses this process in more detail in its guidance on remediating vulnerabilities identified through penetration testing.

What should enterprises do immediately about CVE-2026-10090?

• Inventory all Red Hat ACM hubs currently in operation and record their versions.

• Identify environments using Application Subscription.

• Review RoleBinding and ClusterRoleBinding objects for users, groups, and ServiceAccounts with edit privileges.

• Examine historical creation and modification events involving Channel and Subscription resources.

• Verify whether referenced Helm repositories are included in the organization's approved repository list.

• Search for unusual ClusterRoleBinding objects linking ServiceAccounts to cluster-admin.

• Remove unnecessary or obsolete edit privileges.

• Centralize Kubernetes audit logs and configure alerts for sensitive RBAC changes.

• Monitor Red Hat Product Security for updated patching and advisory information.

For human administrator accounts, Privileged Access Management can help control privileged access, enforce approval workflows, and record administrative sessions. However, Privileged Access Management is an additional security layer and does not replace remediation of the authorization flaw inside Red Hat ACM itself.

What does IPSIP Vietnam's expert perspective show?

If an account obtains cluster-admin, it may be able to affect a wide range of cluster resources. According to Red Hat's CVSS vector, the potential impact on confidentiality, integrity, and availability is rated High.

Organizations should maintain an accurate Asset Inventory for Kubernetes and OpenShift environments, periodically review RBAC, and remove privileges that are no longer required.

IPSIP Vitenam cybersecurity solutions

For organizations in Vietnam operating Red Hat ACM, Kubernetes, or OpenShift at scale, the immediate priorities are to assess exposure, reduce excessive privileges, review RBAC changes, and strengthen monitoring. Although there is currently no confirmed exploitation in the wild, the potential escalation to cluster-admin makes CVE-2026-10090 a vulnerability that should receive high remediation priority.

---

References

Red Hat Product Security - CVE-2026-10090 https://access.redhat.com/security/cve/CVE-2026-10090

NIST National Vulnerability Database - CVE-2026-10090 https://nvd.nist.gov/vuln/detail/CVE-2026-10090

CERT-PY - Vulnerabilidad en productos Red Hat https://www.cert.gov.py/vulnerabilidad-en-productos-red-hat/