CVE-2026-10079 Red Hat CVE debrief

Who should care

Organizations using Red Hat Advanced Cluster Security for Kubernetes, administrators and users with permission to create Deployments in Kubernetes environments, and security teams responsible for vulnerability management and compliance should be aware of this vulnerability and take necessary actions to prevent potential bypass of deploy-time policy detection and enforcement. Affected operators and platform teams should review and update security policies to account for this vulnerability and ensure proper configuration of the openshift.io/encoded-deployment-config label.

Technical summary

A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) allows a user with permission to create Deployments to set the openshift.io/encoded-deployment-config label to 'null', causing ACS to treat the workload as having empty UID, name, and labels, and namespace 'default'. This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central, and breaks violation reporting and compliance correlation for the affected deployment. The issue highlights the importance of proper configuration and monitoring of deployments in Kubernetes environments.

Defensive priority

Organizations using Red Hat Advanced Cluster Security for Kubernetes should verify their deployments and ensure that the openshift.io/encoded-deployment-config label is properly set to prevent potential bypass of deploy-time policy detection and enforcement.

Recommended defensive actions

• Verify deployments and ensure proper configuration of the openshift.io/encoded-deployment-config label
• Monitor for potential policy bypass and enforcement visibility issues
• Review and update security policies to account for this vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates a flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) that allows a user with permission to create Deployments to bypass deploy-time policy detection and enforcement visibility. The issue is related to the openshift.io/encoded-deployment-config label. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should verify deployments and ensure proper configuration of the openshift.io/encoded-deployment-config label to prevent potential bypass of deploy-time policy detection and enforcement.

Official resources