NPM · AUGUST 2026 · EARLY WARNING

Critical Vulnerability in multicloud-operators-subscription Component Reported

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: CRITICAL
CVSS: 9.9
Affected component: multicloud-operators-subscription (npm)
Patched version: Not yet available

CVE-2026-66792

An early warning has been issued for a critical vulnerability in the multicloud-operators-subscription component. This flaw could allow users on a managed cluster to escalate their privileges, potentially leading to unauthorized access and control over cluster resources.

What happened

A flaw has been reported in the multicloud-operators-subscription component, which is part of a managed cluster system. This vulnerability could allow a user to escalate their privileges by creating a Subscription with specific, crafted annotations. If successfully exploited, an attacker could deploy resources into any namespace with the elevated permissions of the controller's Service Account.

The vulnerability appears to affect the multicloud-operators-subscription component, but no authoritative version range has been published yet. The CVSS score for this vulnerability is 9.9, indicating a critical severity level. The vulnerability has been tracked under CVE-2026-66792 and CVE-2026-67567.

What to do about it

Upgrade to the latest version of multicloud-operators-subscription as soon as it becomes available.
Review your cluster configurations for any unauthorized Subscriptions that could be exploiting this vulnerability.
Monitor the primary sources for updates on patched versions and further details.
No official fix has been published yet. Monitor the sources below for updates on any available patches.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If multicloud-operators-subscription is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If your system uses the multicloud-operators-subscription component, you may be affected. However, no authoritative version range has been published yet, so it is unclear which specific versions are vulnerable.

What should I do right now?

Monitor the primary sources for updates on patched versions and further details. Upgrade to the latest version of multicloud-operators-subscription as soon as it becomes available and review your cluster configurations for any unauthorized Subscriptions.

Is there an official fix available?

No official fix has been published yet. Continue to monitor the primary sources for updates on any available patches.

Sources

Join the 0Day waitlist →

← Back to all threats