CVE-2026-66792: Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
Other sources
IsClusterAdmin() decides whether a Subscription may deploy resources into arbitrary namespaces (and propagate cluster-admin: true to child Subscriptions). On the hub it relies on the ocm-mutating-webhook to stamp trusted user-identity/user-group annotations. On a managed cluster the webhook does not exist. The function then returns true whenever both user-settable annotations are present: apps.open-cluster-management.io/hosting-subscription (any non-empty value) and apps.open-cluster-management.io/cluster-admin: true. Any spoke user who can create a Subscription with these annotations gains multi-namespace deployment capability with the controller's privileged SA.
Source: Project Glasswing AI-SAST audit of stolostron/multicloud-operators-subscription. Finding ID: FIND-002 Assurance: executionproven
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66792?
The severity of CVE-2026-66792 is critical with a CVSS score of 9.9.
How does CVE-2026-66792 affect multicloud-operators-subscription?
CVE-2026-66792 allows a user on a managed cluster to escalate their privileges through crafted annotations.
What impact does CVE-2026-66792 have on resource deployment?
Successful exploitation of CVE-2026-66792 enables attackers to deploy resources into any managed cluster.
Who is affected by CVE-2026-66792?
Users on managed clusters utilizing multicloud-operators-subscription are at risk due to CVE-2026-66792.
How can CVE-2026-66792 be mitigated?
Mitigation for CVE-2026-66792 involves restricting user-settable annotations in managed clusters.