CVE-2026-10090: Red Hat ACM Privilege Escalation – Detection & Hardening Guide

---
title: Red Hat ACM Potential Privilege Escalation via Subscription Creation
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects the creation of Channel or Subscription resources by users who do not possess the subscription-admin role, indicative of an attempt to exploit CVE-2026-10090.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-10090
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: kubernetes
  service: audit
detection:
  selection_resource:
    verb: create
    objectRef:
      resource:
        - channels
        - subscriptions
  selection_namespace:
    objectRef:
      namespace|startswith: 'open-cluster-management'
  # Filter out known service accounts or admins that legitimately perform this action
  filter_legit:
    userAgent|contains:
      - 'cluster-admin'
      - 'subscription-admin'
condition: selection_resource and selection_namespace and not filter_legit
falsepositives:
  - Legitimate administrators creating subscriptions manually
level: high
---
title: ACM Subscription Controller External Network Connection
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects the ACM subscription controller process initiating connections to non-internal IP addresses, potentially fetching malicious Helm charts during exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-10090
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:\    Image|endswith: '/subscription-controller'
    DestinationPort:
      - 80
      - 443
  filter_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
condition: selection and not filter_internal
falsepositives:
  - Legitimate subscription updates to approved external registries (e.g. Red Hat GitHub)
level: medium

// Hunt for creation of Subscriptions or Channels in ACM Hub namespaces
// Ensure Kubernetes Audit Logs are connected to Microsoft Sentinel
KubeAuditLogs
| where OperationName =~ "create"
| where ObjectRefResource in ("channels", "subscriptions")
| where ObjectRefNamespace startswith "open-cluster-management"
| extend User = tostring(RequestObject['user']), Username = coalesce(User, Actor, "unknown")
| project TimeGenerated, OperationName, ObjectRefNamespace, ObjectRefName, Username, SourceIPs, RequestURI
| summarize count() by Username, ObjectRefResource

-- Hunt for network connections established by the subscription controller
-- on the Kubernetes node hosting the pod.
SELECT Pid, Family, RemoteAddress, RemotePort, State, CommandLine
FROM netstat()
WHERE ProcessName =~ "subscription"
  AND RemoteAddress NOT IN ("127.0.0.1", "::1", "0.0.0.0")
  AND RemoteAddress NOT IPRANGE("10.0.0.0/8")
  AND RemoteAddress NOT IPRANGE("172.16.0.0/12")
  AND RemoteAddress NOT IPRANGE("192.168.0.0/16")

#!/bin/bash
# Remediation and Verification Script for CVE-2026-10090
# Usage: sudo ./check_acm_cve.sh

echo "[*] Checking for vulnerable Red Hat ACM deployments..."

# 1. Check if multicluster-operators-subscription is deployed
echo "[*] Checking for multicluster-operators-subscription deployment..."
kubectl get deployment -n open-cluster-management multicluster-operators-subscription 2>/dev/null
if [ $? -ne 0 ]; then
    echo "[+] multicluster-operators-subscription not found in open-cluster-management namespace. System may not be vulnerable or installed in non-standard location."
    exit 0
fi

# 2. Identify users with 'edit' access in ACM namespaces (Potential Attackers)
echo "[!] Listing users with 'edit' rolebindings in open-cluster-management namespaces:"
kubectl get rolebindings -A -o  | jq -r '.items[] | select(.metadata.namespace | startswith("open-cluster-management")) | select(.roleRef.name == "edit") | "Namespace: \(.metadata.namespace), User/Group: \(.subjects[]?.name), Kind: \(.subjects[]?.kind)"'

# 3. Check for recent suspicious Subscriptions pointing to external sources
echo "[!] Checking for Subscriptions referencing potentially external (non-git) channels..."
kubectl get subscriptions -A -o  | jq -r '.items[] | select(.spec.channel != null) | "Namespace: \(.metadata.namespace), Name: \(.metadata.name), Channel: \(.spec.channel)"'

echo "[*] Recommendation: Update to the latest patched version of Red Hat ACM immediately."
echo "[*] Restrict 'edit' role access to 'open-cluster-management' namespaces to trusted administrators only."