{"id":"CVE-2026-110744","kind":"vulnerability","aliases":["CVE-2026-110744"],"related":[],"title":"multicluster-global-hub operator: overly broad RBAC allows cluster-wide impersonation","description":"A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.","summary":"The multicluster-global-hub operator bundle ships RBAC permissions that let it impersonate any user, group or service account across the cluster without restriction. An attacker who compromises the operator or its service account credentials can escalate to full cluster administrator.","severity":"high","cvss":7.2,"epss":0.00292,"exploited":false,"exploited_at":null,"products":[{"name":"multicluster-global-hub-operator-bundle","fixed":[],"affected":"unknown (Red Hat lists no versions)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","kubernetes","multicluster-global-hub","openshift","rbac","red-hat-acm"],"not_affected_if":["operator-not-installed"],"how_to_check":"- Check if installed: kubectl get csv -A | grep multicluster-global-hub\n- Inspect the CSV: kubectl get csv -n <ns> <multicluster-global-hub-operator csv> -o yaml and look in spec.install.spec.clusterPermissions for a rule with verbs: [impersonate] on resources users/groups/serviceaccounts and no resourceNames.\n- Also check live: kubectl auth can-i impersonate groups --as=system:serviceaccount:<ns>:<operator-sa>","fix":"unknown: no fixed bundle version published by Red Hat as of 2026-10-25 (Bugzilla 2523007 status NEW, no Fixed In Version). Watch the Red Hat CVE page for an RHSA.","status":"open","published_at":"2026-10-21T18:17:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:29:04+00:00","updated_at":"2026-10-25T03:30:11+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T03:29:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"multicluster-global-hub operator: overly broad RBAC allows cluster-wide impersonation","impact":"high","summary":"The multicluster-global-hub operator bundle ships RBAC permissions that let it impersonate any user, group or service account across the cluster without restriction. An attacker who compromises the operator or its service account credentials can escalate to full cluster administrator.","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","openshift","multicluster-global-hub"],"confidence":0.5,"needs_auth":"yes","worst_case":"attacker gains full cluster administrator control via impersonation","analyst_note":"Find the fixed bundle version and the exact RBAC change in the NVD entry or the vendor advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-110744).","how_to_check":"- Inspect the operator's ClusterRole and ClusterRoleBinding for `impersonate` verbs on `users`, `groups` and `serviceaccounts`, e.g. `kubectl get clusterrole -o yaml | grep -B5 impersonate`\n- Confirm whether the multicluster-global-hub operator is installed, e.g. `kubectl get csv -A | grep multicluster-global-hub`","needs_analyst":true,"not_affected_if":["operator-not-installed"],"who_is_affected":"Teams running the multicluster-global-hub operator bundle to manage multiple Kubernetes clusters. Clusters without this operator installed are not affected by this entry. The sources do not say which operator versions are fixed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":3379,"output_tokens":593,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed bundle version and the exact RBAC change in the NVD entry or the vendor advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-110744).","search":"'-110744':16A,19A '-2026':15A,18A 'access':101C 'account':57B,72B,117C,130C 'achiev':137C 'acm':37B 'across':58B 'administr':79B,142C 'allow':9A 'arbitrari':112C 'attack':64B,121C 'base':100C 'broad':7A,97C 'bundl':44B,90C 'bundle':25A 'cluster':11A,60B,78B,108C,146C 'cluster-wid':10A,107C 'compromis':66B,123C 'configur':94C 'control':102C,143C 'credenti':73B,131C 'cve':14A,17A 'escal':75B,139C 'exploit':133C 'flaw':81C,135C 'found':83C 'full':77B,141C 'gain':140C 'global':3A,22A,30B,41B,87C 'grant':106C 'group':54B,114C 'hat':36B 'hub':4A,23A,31B,42B,88C 'imperson':13A,51B,110C 'infrastructur':26B 'kubernet':27B 'let':49B 'multiclust':2A,29B,40B,86C 'multicluster':21A 'multicluster-global-hub':1A,28B,39B 'multicluster-global-hub-operator-bundl':85C 'multicluster-global-hub-operator-bundle':20A 'obtain':127C 'openshift':32B 'oper':5A,43B,68B,89C,92C,125C 'operator':24A 'over':6A,96C 'permiss':47B,104C 'privileg':138C 'rbac':8A,33B,46B,103C 'red':35B 'red-hat-acm':34B 'restrict':62B,119C 'role':99C 'role-bas':98C 'servic':56B,71B,116C,129C 'ship':45B 'user':53B,113C 'wide':12A,109C 'without':61B,118C","nicknames":[],"mitigations":[],"who_affected":"Clusters running the Red Hat Multicluster Global Hub operator (stolostron multicluster-global-hub-operator-bundle, part of Red Hat Advanced Cluster Management). The operator's service account can impersonate any user or group, including system:masters, so anyone who steals its token or compromises its pod gets cluster-admin on the hub cluster. Exploitation needs that prior access (Red Hat rates it PR:High); clusters without the operator can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110744","severity":null,"published_at":"2026-10-21T18:17:23+00:00","modified_at":"2026-10-23T15:17:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110744","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110744","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110744:731","url":null,"severity":null,"published_at":"2026-10-25T03:30:11+00:00","modified_at":"2026-10-25T03:30:11+00:00","first_seen_at":"2026-10-25T03:30:11+00:00","fetched_at":"2026-10-25T03:30:11+00:00","note":"Red Hat CVE page and Bugzilla 2523007 read: CSV clusterPermissions give operator SA impersonate on users/groups (and serviceaccounts) with no resourceNames, so system:masters is reachable. No fixed version published; Bugzilla status NEW, no mitigation per Red Hat. No exploitation or PoC found. Nothing marked verified because no fix exists."}],"documents":[{"id":3199,"url":"https://access.redhat.com/security/cve/cve-2026-110744","title":"Red Hat CVE-2026-110744","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3201,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523007","title":"Red Hat Bugzilla 2523007","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}