---
id: "CVE-2026-110744"
kind: "vulnerability"
aliases: ["CVE-2026-110744"]
title: "multicluster-global-hub operator: overly broad RBAC allows cluster-wide impersonation"
severity: "high"
cvss: 7.2
epss: 0.00292
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "multicluster-global-hub-operator-bundle", "fixed": [], "affected": "unknown (Red Hat lists no versions)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "kubernetes", "multicluster-global-hub", "openshift", "rbac", "red-hat-acm"]
not_affected_if: ["operator-not-installed"]
published_at: "2026-10-21T18:17:23+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:30:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110744", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110744", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:30:11+00:00"}]
---

# multicluster-global-hub operator: overly broad RBAC allows cluster-wide impersonation

The multicluster-global-hub operator bundle ships RBAC permissions that let it impersonate any user, group or service account across the cluster without restriction. An attacker who compromises the operator or its service account credentials can escalate to full cluster administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:multicluster-global-hub-operator-bundle affected unknown (Red Hat lists no versions) fixed ?

## How to check

- Check if installed: kubectl get csv -A | grep multicluster-global-hub
- Inspect the CSV: kubectl get csv -n <ns> <multicluster-global-hub-operator csv> -o yaml and look in spec.install.spec.clusterPermissions for a rule with verbs: [impersonate] on resources users/groups/serviceaccounts and no resourceNames.
- Also check live: kubectl auth can-i impersonate groups --as=system:serviceaccount:<ns>:<operator-sa>

## Fix

unknown: no fixed bundle version published by Red Hat as of 2026-10-25 (Bugzilla 2523007 status NEW, no Fixed In Version). Watch the Red Hat CVE page for an RHSA.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110744
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110744
- 2026-10-25T03:30:11+00:00 analyst — Red Hat CVE page and Bugzilla 2523007 read: CSV clusterPermissions give operator SA impersonate on users/groups (and serviceaccounts) with no resourceNames, so system:masters is reachable. No fixed version published; Bugzilla status NEW, no mitigation per Red Hat. No exploitation or PoC found. Nothing marked verified because no fix exists.

## Documents

- [advisory] Red Hat CVE-2026-110744 https://access.redhat.com/security/cve/cve-2026-110744
- [describes] Red Hat Bugzilla 2523007 https://bugzilla.redhat.com/show_bug.cgi?id=2523007

## From the sources

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_