Live › vulnerability › CVE-2026-110744
Go to dashboardThe multicluster-global-hub operator bundle ships RBAC permissions that let it impersonate any user, group or service account across the cluster without restriction. An attacker who compromises the operator or its service account credentials can escalate to full cluster administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Clusters running the Red Hat Multicluster Global Hub operator (stolostron multicluster-global-hub-operator-bundle, part of Red Hat Advanced Cluster Management). The operator's service account can impersonate any user or group, including system:masters, so anyone who steals its token or compromises its pod gets cluster-admin on the hub cluster. Exploitation needs that prior access (Red Hat rates it PR:High); clusters without the operator can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| multicluster-global-hub-operator-bundle | vendor | unknown (Red Hat lists no versions) | – |
bundle version published by Red Hat as of 2026-10-25 (Bugzilla 2523007 status NEW, no Fixed In Version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.
This page as .md · .json · in your agent: get_signal("CVE-2026-110744")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.