CVE-2026-10090 Details

A privilege escalation vulnerability exists in the Application Subscription controller of Red Hat Advanced Cluster Management for Kubernetes (ACM) version 2. A user with namespace-scoped 'edit' privileges in an ACM hub namespace can exploit this flaw by creating a Channel resource that points to a Helm repository they control, along with a Subscription resource that references it. The app-subscription controller then fetches and applies the contents of the Helm chart using elevated permissions, without verifying if the user has the 'open-cluster-management:subscription-admin' role or restricting the applied resources to the subscription namespace. This oversight allows the inclusion of cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding that grants the user's ServiceAccount the 'cluster-admin' role. Exploiting this vulnerability leads to unauthorized privilege escalation to cluster-admin, contradicting ACM's documentation that states non-subscription-admin users should only have resources deployed in their subscription namespace.