Red Hat has identified a critical privilege escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes (ACM), allowing users with limited namespace-level editing permissions to gain full cluster-admin access throughout a Kubernetes environment This article explores kubernetes environments attacker. . Assigned an Important severity rating and a CVSS score of 9.9 out of 10, Red Hat announced this issue on August 5, 2026.
Namespace-scoped edit permissions are sufficient for exploitation. A compromise of the hub can be particularly damaging, allowing an attacker with cluster-admin privileges on the hub to alter workloads, access secrets, establish persistence through controllers or admission resources, modify identity bindings, and potentially impact managed-cluster operations based on the environment.
CVE-2026-10090 successfully sidestepped expectations by allowing a limited editor to deploy highly privileged objects across clusters, making it particularly damaging for organizations using ACM in multiple Kubernetes environments. An attacker with cluster-admin on the hub can alter workloads, access secrets, establish persistence through controllers and admission resources, modify identity bindings, and potentially affect managed-cluster operations depending on the environment. Until then, defenders must restrict namespace edit permissions in ACM hub namespaces, review who can create or modify Channel and Subscription resources, and ensure audits for unexpected cluster-scoped objects.
Utilize browser-based data inspection from ANY.RUN to detect, investigate, and respond more quickly, enhancing your SOC and reducing Mean Time To Resolution (MTTR).
