Red Hat Multicluster Global Hub: Privilege escalation via overly broad impersonation RBAC
Summary
The operator bundle of Red Hat Multicluster Global Hub grants its service account cluster-wide impersonation of arbitrary users, groups and service accounts without restriction. An attacker who has compromised the operator or obtained its service account credentials can impersonate privileged identities, such as system:masters, and gain full administrative control over the cluster. The attacker needs high privileges to reach the operator or its credentials first.
Affected
- Red Hat Multicluster Global Hub (operator bundle multicluster-global-hub-operator-bundle)
- Affected versions: Unknown.
Fixed in
- Unknown. No Red Hat errata naming this CVE has been confirmed.
- An upstream change removing the unused impersonation permissions exists (stolostron PR 2932), but its shipping version in Red Hat builds is unknown.
Workaround
- Mitigation is not available according to Red Hat.
- Review the operator's ClusterRole and ClusterRoleBindings for impersonate permissions and restrict them where possible.
- Audit who or what can use the operator's service account.
Exploitation
- Exploitation in the wild: Not known.
- Public proof of concept: None found.
- CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
- VulDB rates exploitation as easy and estimates an exploit price of USD 5k-25k; this is a commercial estimate, not evidence of exploitation.
Our recommendation
- Check whether Multicluster Global Hub is deployed, typically in RHACM global hub setups run by platform teams.
- If deployed, review the operator's RBAC for impersonation rights and limit access to the operator's service account and credentials.
- Monitor the Red Hat advisory and upgrade the operator bundle as soon as a fixed build is confirmed.
- Most SMEs are not affected and need no immediate action.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page access.redhat.com
- Red Hat Bugzilla 2523007 bugzilla.redhat.com
- stolostron PR 2932 (upstream fix) github.com
- OpenCVE CVE-2026-110744 app.opencve.io
- VulDB 424931 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 04:12.
Original description (NVD)
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.