CVE-2026-110744
Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.
| CWE | CWE-269 |
| Vendor | red hat |
| Product | multicluster global hub |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat multicluster global hub
Be the first to know when new high vulnerabilities affecting red hat multicluster global hub are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Red Hat / Multicluster Global Hub
All versions affected