CVE-2026-66792: Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66792?
The severity of CVE-2026-66792 is critical with a CVSS score of 9.9.
How does CVE-2026-66792 affect multicloud-operators-subscription?
CVE-2026-66792 allows a user on a managed cluster to escalate their privileges through crafted annotations.
What impact does CVE-2026-66792 have on resource deployment?
Successful exploitation of CVE-2026-66792 enables attackers to deploy resources into any managed cluster.
Who is affected by CVE-2026-66792?
Users on managed clusters utilizing multicloud-operators-subscription are at risk due to CVE-2026-66792.
How can CVE-2026-66792 be mitigated?
Mitigation for CVE-2026-66792 involves restricting user-settable annotations in managed clusters.