boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-66792

CVE-2026-66792CRITICAL
Red Hat Multicluster Global Hub 1.4.9 — Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0069   51.1     —
AFFECTED
  Product                                                  Versions     Fixed
  Multicluster Global Hub 1.4.9                            unspecified  1788355439
  Multicluster Global Hub 1.4.9                            unspecified  1788355599
  Multicluster Global Hub 1.4.9                            unspecified  1788355417
  Multicluster Global Hub 1.5.8                            unspecified  1789515408
  Multicluster Global Hub 1.5.8                            unspecified  1789515288
  Multicluster Global Hub 1.5.8                            unspecified  1789478830
  Multicluster Global Hub 1.6.6                            unspecified  1790085494
  Multicluster Global Hub 1.6.6                            unspecified  1790086176
  Multicluster Global Hub 1.6.6                            unspecified  1790085268
  Red Hat Advanced Cluster Management for Kubernetes 2.11  unspecified  1787262214
  + 28 more
TIMELINE
  Jul 27  Reserved by redhat
  Aug 17  Published (CNA: redhat)
  Aug 26  PATCH SHIPPED — CVE-2026-66792 (Red Hat Advanced Cluster Management for Kubernetes 2.11). Fixed in Red Hat Advanced Cluster Management for Kubernetes 2.11 1787262214.
CWE-863 · CNA: redhat · CVSS v3.1 · 11 references · NVD status: Awaiting Analysis

Description

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
July 27, 2026ReservedReserved by redhat
August 17, 2026PublishedPublished (CNA: redhat)
August 26, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-66792 (Red Hat Advanced Cluster Management for Kubernetes 2.11). Fixed in Red Hat Advanced Cluster Management for Kubernetes 2.11 1787262214.

Affected

Affected products and packages — 38 rows
VendorProduct / PackageEcosystemVersion introducedFixed
Red HatMulticluster Global Hub 1.4.9——1788355439
Red HatMulticluster Global Hub 1.4.9——1788355599
Red HatMulticluster Global Hub 1.4.9——1788355417
Red HatMulticluster Global Hub 1.5.8——1789515408
Red HatMulticluster Global Hub 1.5.8——1789515288
Red HatMulticluster Global Hub 1.5.8——1789478830
Red HatMulticluster Global Hub 1.6.6——1790085494
Red HatMulticluster Global Hub 1.6.6——1790086176
Red HatMulticluster Global Hub 1.6.6——1790085268
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.11——1787262214
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.11——1787263584
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13——1787259284
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13——1787263693
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14——1786976940
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14——1787170830
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15——1787238598
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15——1787240030
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16——1787242135
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16——1787242321
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.17——1787242131
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.17——1787242108
Red HatRed Hat Advanced Cluster Management for Kubernetes 2———
Red HatRed Hat Advanced Cluster Management for Kubernetes 2———
Red HatRed Hat Advanced Cluster Management for Kubernetes 2———
Red HatRed Hat Advanced Cluster Management for Kubernetes 2———
Red HatRed Hat Advanced Cluster Management for Kubernetes 2———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat Openshift Data Foundation 4———
Red HatRed Hat Openshift Data Foundation 4———
Red HatRed Hat Openshift Data Foundation 4———

Weaknesses

CWE-863

References (11)

Related

Authoritative record: CVE-2026-66792 at cve.org

Vendors: red hat

Weaknesses: CWE-863

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-66792 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.