External risk intelligence

Multicloud-Operators-Subscription HelmRelease Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-67567

The vulnerability resides in a multicloud-operators-subscription component requiring authenticated tenant access to create custom resources. This functionality is typically restricted to internal cluster administrators or authorized users within a private orchestration environment, making public internet exposure uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the multicloud-operators-subscription component, allowing authenticated users with specific permissions to bypass security controls and deploy arbitrary resources across the entire cluster. This could lead to a significant security compromise by enabling unauthorized actions within the affected environment.

Users can deploy anything on the cluster.
Confirms potential for tenant abuse in multicloud.
Verify if tenant-creation capabilities are exposed.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to create specific custom resources in a multicloud environment could exploit a flaw in the HelmRelease controller. This component, responsible for processing Helm chart templates, runs with elevated privileges and lacks sufficient validation. By leveraging this, a tenant could deploy unauthorized resources anywhere in the cluster, resulting in a complete security compromise.

Tenant can create custom resources.
Controller processes templates without validation.
Arbitrary resource deployment across cluster.

Live Threat

Current exploitation, exposure, and threat context

A tenant with the ability to create HelmRelease custom resources could bypass security controls. This is because the HelmRelease controller processes Helm chart templates with elevated privileges without proper validation, allowing the tenant to deploy arbitrary resources cluster-wide.

Cluster resources and configurations.
Tenant deploys arbitrary cluster resources.
Complete compromise of the cluster.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a multicloud-operators-subscription deployment, application owners and platform teams are likely responsible for addressing this flaw. The first practical step is to identify all instances of the affected component, confirm its accessibility and criticality, and then assign ownership for remediation planning.

Assign responsibility to platform teams.
Verify affected component exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the multicloud-operators-subscription component?

This component is a software module designed to manage and automate the deployment of applications across multiple cloud environments. It specifically handles Helm chart templates, which are packages used to define and install complex Kubernetes applications. By automating these subscriptions, the software allows teams to maintain consistent application states across varied, distributed cloud infrastructures.

What does CVE-2026-67567 mean for system security?

This vulnerability is classified as Unintended Proxy or Intermediary (CWE-441). It occurs because the HelmRelease controller processes templates using high-level system permissions rather than the user's restricted permissions. Since the controller fails to validate these templates properly, it acts as a confused proxy, allowing a user to execute unauthorized actions with the controller's elevated authority.

How can an attacker trigger this vulnerability?

An attacker must have existing, authenticated access that permits them to create HelmRelease custom resources within the environment. If a user lacks the specific permission to create these custom resources, they cannot trigger the flaw. Simply having general read-only access or being an unauthenticated visitor to the cluster is not sufficient to exploit this issue.

Is my multicloud-operators-subscription instance at risk?

According to Halo Surface Signal, this vulnerability is unlikely to be exposed to the public internet. Because the flaw requires authenticated tenant access to create specific custom resources, it is typically limited to internal private orchestration environments where only authorized users or administrators interact with the cluster's management layer.

What should I do if I run this technology?

You should begin by identifying every instance of the multicloud-operators-subscription component within your environment. Once identified, work with your platform team to review who has the authority to create HelmRelease custom resources. Use this information to assess your risk level and coordinate a remediation plan to restrict or better monitor these specific configuration capabilities.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.