Description

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-17T19:16:34.237Z",
  "pubdate": "2026-08-17T19:16:34.237Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in the multicloud-operators-subscription component. This security flaw enables a low-privileged user operating within a managed cluster to achieve unauthorized privilege escalation. By creating a specially crafted Subscription object populated with specific, malicious annotations, an attacker can manipulate the controller's operational logic. Successful exploitation of this vulnerability grants the attacker the capability to deploy arbitrary resources into any cluster namespace. These resources inherit the elevated permissions and privileges associated with the controller's Service Account, bypassing standard role-based access control (RBAC) boundaries. The risk implications include full administrative control, unauthorized resource provisioning, and compromise of cluster confidentiality, integrity, and availability. Exploitation requires user access to a managed cluster with the ability to create Subscription resources. No specific version numbers or external network exposures are required beyond the local cluster context.",
  "technicalDetails": "The vulnerability resides within the multicloud-operators-subscription component, specifically in how it processes and validates annotations on incoming Subscription custom resources originating from managed clusters. The root cause stems from insufficient validation and improper authorization checks performed by the controller when parsing user-supplied metadata. When a user with access to a managed cluster creates a Subscription object containing maliciously crafted annotations, the controller fails to properly sanitize or restrict the target namespaces and associated deployment scopes.\nThe attack flow proceeds as follows: First, the authenticated low-privileged user on the managed cluster instantiates a Subscription custom resource containing targeted, malicious annotations designed to override default scoping or namespace restriction mechanisms. Second, the multicloud-operators-subscription controller processes the incoming Subscription object without adequately validating whether the requesting user possesses authorization to deploy resources into the targeted destination namespaces. Third, the controller evaluates the crafted annotations, misinterpreting the operational parameters and bypassing standard namespace isolation controls.\nFinally, acting with the elevated permissions of its own Service Account, the controller deploys the requested resources into arbitrary namespaces designated by the attacker. Because the controller operates with high-privilege permissions required for multi-cluster orchestration, the deployed payloads inherit these expansive capabilities. This grants the attacker indirect write and deployment access across namespaces they would otherwise be prohibited from modifying. The post-exploitation impact includes unauthorized deployment of workloads, potential lateral movement across namespaces, access to sensitive secrets or configuration data, and complete subversion of multi-tenant security boundaries within the managed cluster environment."
}