Red Hat cluster management flaw lets a namespace editor become cluster admin

Red Hat disclosed a critical flaw in its Advanced Cluster Management for Kubernetes that lets a user with only namespace-level edit rights escalate to full cluster administrator. Tracked as CVE-2026-10090 and scored 9.9, the bug is in the application subscription controller: a low-privileged user can create a channel pointing to a Helm repository they control, then a subscription referencing it, and the controller deploys the chart using its own elevated permissions without checking the requester's authorization. It is a confused-deputy problem that crosses the namespace-to-cluster boundary. Because namespace edit access is often granted broadly to developers, many multi-tenant clusters could be exposed, and no fix was available at disclosure.

Check

Identify Advanced Cluster Management hub namespaces where non-administrators hold edit rights, restrict those permissions, and monitor for unexpected channel and subscription objects pointing to external Helm repositories.

Affected

Organizations running Red Hat Advanced Cluster Management for Kubernetes (CVE-2026-10090); a user with namespace edit rights on the hub can reach full cluster-admin and access secrets, with no fix yet.

Fix

Tighten who holds namespace edit access on ACM hubs, watch for suspicious channel and subscription resources, and apply Red Hat's fix as soon as it ships, since no mitigation fully substitutes.