Red Hat Advanced Cluster Management Privilege Escalation Vulnerability CVE-2026-17107

A high-severity vulnerability in Red Hat Advanced Cluster Management allows authenticated users to escalate privileges to cluster-admin on managed clusters by exploiting improper handling of impersonation headers.

Key Points:

• CVE-2026-17107 is a high-severity (CVSS 8.5) impersonation vulnerability affecting Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE).
• The flaw allows an authenticated hub principal to inject Impersonate-Group headers that are passed through the cluster-proxy service-proxy without sanitization.
• Exploitation results in privilege escalation to cluster-admin on all managed clusters due to unrestricted impersonation permissions on the spoke ServiceAccount.
• No public proof of concept is available, and no patch details have been released as of the advisory publication date.

The vulnerability, identified as CVE-2026-17107, stems from a security boundary bypass within the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management. This component is designed to append impersonation group headers to proxied requests but fails to remove any caller-supplied impersonation group values from incoming requests. This oversight allows an attacker with legitimate access to the hub cluster to manipulate the request flow.

An authenticated hub principal can exploit this flaw by crafting a request that includes an Impersonate-Group header specifying a high-privilege group, such as system:masters. Because the service-proxy does not sanitize this input, the injected header is appended to the request. Combined with the unrestricted impersonation permissions held by the spoke ServiceAccount, the request is processed with the elevated privileges specified in the injected header, granting the attacker cluster-admin access on every managed cluster.

How are organizations currently monitoring for unauthorized impersonation header injections in their Kubernetes cluster management setups?

Learn More: The Hacker Wire

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)