CVE-2026-66792

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66792", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-27T17:51:24.886Z", "datePublished": "2026-08-17T18:12:36.136Z", "dateUpdated": "2026-09-29T16:44:20.747Z"}, "containers": {"cna": {"title": "Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources."}], "affected": [{"vendor": "Red Hat", "product": "Multicluster Global Hub 1.4.9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "defaultStatus": "affected", "versions": [{"version": "1788355439", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.4.9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "defaultStatus": "affected", "versions": [{"version": "1788355599", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.4.9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1788355417", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.5.8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "defaultStatus": "affected", "versions": [{"version": "1789515408", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.5.8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "defaultStatus": "affected", "versions": [{"version": "1789515288", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.5.8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1789478830", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.6.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "defaultStatus": "affected", "versions": [{"version": "1790085494", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.6.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "defaultStatus": "affected", "versions": [{"version": "1790086176", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"]}, {"vendor": "Red Hat", "product": "Multicluster Global Hub 1.6.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1790085268", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-application-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787262214", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787263584", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-application-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787259284", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787263693", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-application-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786976940", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787170830", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-application-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787238598", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787240030", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-application-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242135", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242321", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-application-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242131", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787242108", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:acm:2.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:acm:2"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhacm2/cert-policy-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:acm:2"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhacm2/config-policy-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:acm:2"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhacm2/governance-policy-propagator-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:acm:2"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhacm2/search-collector-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:acm:2"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/cnf-tests-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/lifecycle-agent-operator-bundle", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/lifecycle-agent-rhel9-operator", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/topology-aware-lifecycle-manager-aztp-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/topology-aware-lifecycle-manager-recovery-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/topology-aware-lifecycle-manager-rhel8-operator", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/topology-aware-lifecycle-manager-rhel9-operator", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/ztp-site-generate-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "odf4/odf-cli-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"]}, {"vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "odf4/odf-multicluster-rhel9-operator", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"]}, {"vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "odf4/odr-rhel9-operator", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:67516", "name": "RHSA-2026:67516", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:71597", "name": "RHSA-2026:71597", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:73419", "name": "RHSA-2026:73419", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-66792", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507537", "name": "RHBZ#2507537", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-17T17:25:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-863: Incorrect Authorization", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-07-27T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-17T17:25:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-29T16:44:20.747Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T14:53:42.904208Z", "id": "CVE-2026-66792", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T14:53:53.453Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66792", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T14:53:42.904208Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T14:53:48.260Z"}}], "cna": {"title": "Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.4.9", "versions": [{"status": "unaffected", "version": "1788355439", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.4.9", "versions": [{"status": "unaffected", "version": "1788355599", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.4.9", "versions": [{"status": "unaffected", "version": "1788355417", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.5.8", "versions": [{"status": "unaffected", "version": "1789515408", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.5.8", "versions": [{"status": "unaffected", "version": "1789515288", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.5.8", "versions": [{"status": "unaffected", "version": "1789478830", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.6.6", "versions": [{"status": "unaffected", "version": "1790085494", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.6.6", "versions": [{"status": "unaffected", "version": "1790086176", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"], "vendor": "Red Hat", "product": "Multicluster Global Hub 1.6.6", "versions": [{"status": "unaffected", "version": "1790085268", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787262214", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-application-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787263584", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787259284", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-application-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787263693", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1786976940", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-application-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1787170830", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787238598", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-application-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787240030", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787242135", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-application-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787242321", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787242131", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-application-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787242108", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:acm:2"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "packageName": "rhacm2/cert-policy-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:acm:2"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "packageName": "rhacm2/config-policy-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:acm:2"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "packageName": "rhacm2/governance-policy-propagator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:acm:2"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "packageName": "rhacm2/search-collector-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/cnf-tests-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/lifecycle-agent-operator-bundle", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/lifecycle-agent-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/topology-aware-lifecycle-manager-aztp-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/topology-aware-lifecycle-manager-recovery-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/topology-aware-lifecycle-manager-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/topology-aware-lifecycle-manager-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/ztp-site-generate-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4", "packageName": "odf4/odf-cli-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4", "packageName": "odf4/odf-multicluster-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4", "packageName": "odf4/odr-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-07-27T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-17T17:25:00.000Z", "value": "Made public."}], "datePublic": "2026-08-17T17:25:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "name": "RHSA-2026:60386", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "name": "RHSA-2026:60387", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "name": "RHSA-2026:60388", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "name": "RHSA-2026:60389", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "name": "RHSA-2026:60390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "name": "RHSA-2026:60391", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:67516", "name": "RHSA-2026:67516", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:71597", "name": "RHSA-2026:71597", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:73419", "name": "RHSA-2026:73419", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-66792", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507537", "name": "RHBZ#2507537", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-29T16:44:20.747Z"}, "x_redhatCweChain": "CWE-863: Incorrect Authorization"}}, "cveMetadata": {"cveId": "CVE-2026-66792", "state": "PUBLISHED", "dateUpdated": "2026-09-29T16:44:20.747Z", "dateReserved": "2026-07-27T17:51:24.886Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-17T18:12:36.136Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "product": "Multicluster Global Hub 1.4.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1788355439", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "product": "Multicluster Global Hub 1.4.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1788355599", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.4::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "product": "Multicluster Global Hub 1.4.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1788355417", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "product": "Multicluster Global Hub 1.5.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1789515408", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "product": "Multicluster Global Hub 1.5.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1789515288", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.5::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "product": "Multicluster Global Hub 1.5.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1789478830", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "product": "Multicluster Global Hub 1.6.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1790085494", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "product": "Multicluster Global Hub 1.6.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1790086176", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_globalhub:1.6::el9"], "defaultStatus": "affected", "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "product": "Multicluster Global Hub 1.6.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1790085268", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.11::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-application-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787262214", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.11::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787263584", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.13::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-application-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787259284", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.13::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787263693", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.14::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-application-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786976940", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.14::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787170830", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.15::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-application-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787238598", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.15::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787240030", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.16::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-application-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242135", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.16::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242321", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.17::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-application-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242131", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:acm:2.17::el9"], "defaultStatus": "affected", "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787242108", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/cert-policy-controller-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/config-policy-controller-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/governance-policy-propagator-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/search-collector-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift4/cnf-tests-rhel8", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift4/lifecycle-agent-operator-bundle", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift4/lifecycle-agent-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift4/topology-aware-lifecycle-manager-aztp-rhel9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift4/topology-aware-lifecycle-manager-recovery-rhel9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift4/topology-aware-lifecycle-manager-rhel8-operator", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift4/topology-aware-lifecycle-manager-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift4/ztp-site-generate-rhel8", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "defaultStatus": "unaffected", "packageName": "odf4/odf-cli-rhel9", "product": "Red Hat Openshift Data Foundation 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "defaultStatus": "unaffected", "packageName": "odf4/odf-multicluster-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "defaultStatus": "unaffected", "packageName": "odf4/odr-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources."}], "id": "CVE-2026-66792", "lastModified": "2026-09-29T17:17:08.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66792", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T14:53:42.904208Z", "version": "2.0.3"}}]}, "published": "2026-08-17T19:16:34.237", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60386"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60387"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60388"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60389"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60390"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60391"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:67516"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:71597"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:73419"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-66792"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507537"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "multicloud-operators-subscription: multicloud-operators-subscription: IsClusterAdmin() trusts user-settable annotations on managed clusters", "id": "2507537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507537"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-66792", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/acm-governance-policy-framework-addon-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/cert-policy-controller-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/config-policy-controller-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/governance-policy-propagator-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/multicluster-operators-application-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/multicluster-operators-subscription-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/search-collector-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/cnf-tests-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/lifecycle-agent-operator-bundle", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/lifecycle-agent-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/topology-aware-lifecycle-manager-aztp-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/topology-aware-lifecycle-manager-recovery-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/topology-aware-lifecycle-manager-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/topology-aware-lifecycle-manager-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ztp-site-generate-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Not affected", "impact": "low", "package_name": "odf4/odf-cli-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Not affected", "impact": "low", "package_name": "odf4/odf-multicluster-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Not affected", "impact": "low", "package_name": "odf4/odr-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}], "public_date": "2026-08-17T17:25:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66792\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66792"], "statement": "Critical: This flaw in Red Hat Advanced Cluster Management for Kubernetes allows a privileged user on a managed cluster to escalate privileges to cluster-admin. By crafting a Subscription with specific user-settable annotations, an attacker can bypass intended security controls and deploy resources across multiple namespaces with elevated permissions, leading to full compromise of the managed cluster.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "Red Hat Advanced Cluster Management for Kubernetes 2", "source": "cna", "vendor": "Red Hat"}, "product": "advanced_cluster_management_for_kubernetes", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Multicluster Global Hub", "source": "cna", "vendor": "Red Hat"}, "product": "multicluster_globalhub", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Container Platform 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_container_platform", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "Red Hat Openshift Data Foundation 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_data_foundation", "vendor": "redhat"}], "created": "2026-08-17T19:30:17.609369+00:00", "updated": "2026-08-21T21:19:37.049187+00:00", "vendors": ["redhat", "redhat$PRODUCT$advanced_cluster_management_for_kubernetes", "redhat$PRODUCT$multicluster_globalhub", "redhat$PRODUCT$openshift_container_platform", "redhat$PRODUCT$openshift_data_foundation"]}