RHACM app-subscription: namespace edit rights escalate to cluster-admin via attacker-hosted Helm chart

Impact

A user holding only namespace-scoped edit rights on an ACM hub can create a Channel pointing at a Helm repository they control plus a Subscription referencing it. The subscription controller fetches that chart and applies it with its own elevated authority, without checking for the subscription-admin role and without confining the applied objects to the subscription namespace. Cluster-scoped resources in the chart therefore land as-is, so a ClusterRoleBinding granting the attacker's ServiceAccount cluster-admin gets created for them. On a fleet where the ACM hub governs GPU clusters, that is full control of the hub and, through it, the managed spokes: any tenant workload, node label, taint or scheduling policy on the accelerator fleet becomes editable.

Who can reach it

Authenticated user with edit privileges in any namespace on the ACM hub, plus the ability to host a Helm repository the hub can reach. No prior cluster-scoped permission required.

What to do

Apply the Red Hat errata for your ACM stream (RHSA-2026:60386 through 60390 cover 2.11 and 2.13 through 2.17). This is a hub-side operator update - the ACM operator redeploys the subscription controller pods; managed spoke clusters and GPU nodes are not rebooted. Before patching, audit existing Channel and Subscription objects in tenant namespaces and review ClusterRoleBindings created since the affected controllers were deployed, since exploitation leaves a durable binding behind.

References

Related entries

• OpenChoreo cluster gateway: unauthenticated internal listener exposes cross-tenant secrets and pod execCVE-2026-73842 · OpenChoreo cluster gateway (internal /api/proxy, /api/exec, /api/wirelogs listener)Critical
• Argo Workflows (controller, podSpecPatch in Strict/Secure template reference mode): A podSpecPatch on the submittedCVE-2026-31892 · Argo Workflows (controller, podSpecPatch in Strict/Secure template reference mode)High
• Argo Workflows (controller, ArtifactGC.PodSpecPatch / template reference allow-list): The allow-list that is supposedCVE-2026-54526 · Argo Workflows (controller, ArtifactGC.PodSpecPatch / template reference allow-list)High
• CRI-O: Ambient-capability mishandling runs containers with elevated privilegesCVE-2018-1000400 · CRI-OHigh
• Harbor: Privilege escalation in the Harbor registryCVE-2019-19023 · HarborHigh
• Rancher: Incorrectly applied authorization check lets a namespace be moved into a different projectCVE-2020-10676 · RancherHigh