Bug 2523007 (CVE-2026-110744)

Summary:	CVE-2026-110744 multicluster-global-hub-operator-bundle: Operator ServiceAccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, jbalunas, rhaigner, security-response-team, tsze
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 19:23:51 UTC

## Operator ClusterRole grants cluster-wide impersonation of users, groups, and service accounts

**CWEs:** CWE-269
**CVSS:** 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
**Component:** stolostron/multicluster-global-hub-operator-bundle

### Description
The CSV clusterPermissions grant the multicluster-global-hub-operator service account the `impersonate` verb on core `users` and `groups` (and on `serviceaccounts`) with no resourceNames scoping. Impersonation of arbitrary groups includes system:masters, which the API server treats as cluster-admin regardless of RBAC bindings. This makes the operator identity cluster-admin-equivalent by construction: the RBAC boundary provides no containment if the operator pod, its projected token, or its kubeconfig is compromised.

### Affected Locations
- `:`
- `:`

### Evidence
**clusterPermissions rule, CSV lines 696-702 — unrestricted impersonation**
```yaml
- apiGroups:
  - ""
  resources:
  - groups
  - users
  verbs:
  - impersonate
```

### Attack Pattern
An attacker who compromises the operator pod or steals its service-account token gains full hub-cluster admin by impersonating privileged users or groups.

---
*Source: Ex-Wing security assessment, finding FIND-001*