Bug 2507537 (CVE-2026-66792) - CVE-2026-66792 multicloud-operators-subscription: multicloud-operators-subscription: IsClusterAdmin() trusts user-settable annotations on managed clusters
Summary: CVE-2026-66792 multicloud-operators-subscription: multicloud-operators-subscr...
Keywords:
Status: NEW
Alias: CVE-2026-66792
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-27 15:45 UTC by OSIDB Bzimport
Modified: 2026-08-17 17:36 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-27 15:45:29 UTC 
IsClusterAdmin() decides whether a Subscription may deploy resources into arbitrary namespaces (and propagate cluster-admin: true to child Subscriptions). On the hub it relies on the ocm-mutating-webhook to stamp trusted user-identity/user-group annotations. On a managed cluster the webhook does not exist. The function then returns true whenever both user-settable annotations are present: apps.open-cluster-management.io/hosting-subscription (any non-empty value) and apps.open-cluster-management.io/cluster-admin: true. Any spoke user who can create a Subscription with these annotations gains multi-namespace deployment capability with the controller's privileged SA.

Source: Project Glasswing AI-SAST audit of stolostron/multicloud-operators-subscription.
Finding ID: FIND-002
Assurance: execution_proven
Note You need to log in before you can comment on or make changes to this bug.