Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide (Red Hat Multicluster Global Hub)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.37 % · percentile 30 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Awaiting Analysis
Description
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.
Weaknesses (CWE)
- CWE-269 — Improper Privilege Management
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-107418
- GCVE · GCVE-0-2026-110744
Affected products
| Product | Versions |
|---|---|
| Red Hat · Multicluster Global Hub |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |