{"id":"CVE-2026-110744","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-110744","generatedAt":"2026-10-28T02:57:30.615Z","title":"The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction.","description":"A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.","published":"2026-10-21T18:17:23.000Z","lastModified":"2026-10-23T15:17:24.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-269"],"affected":[],"epss":{"score":0.00366,"percentile":0.30168,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00292,"percentile":0.20638}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T18:17:23.000Z","detail":{"score":"7.2","severity":"HIGH","publishedAt":"2026-10-21T18:17:23.350Z"},"summary":"New CVE, high severity (CVSS 7.2)."}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-110744","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523007","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110744","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}