Vulnerability · Published Jul 31, 2026 · Assigned by redhat

CVE-2026-10079Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection

High 8.5

In plain English

A high-severity insufficient verification of data authenticity in Red Hat Advanced Cluster Security 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name and labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Security 4	see references
Red Hat	Red Hat Advanced Cluster Security 4	see references
Red Hat	Red Hat Advanced Cluster Security 4	see references

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

References

https://access.redhat.com/security/cve/CVE-2026-10079 vdb-entry, x_refsource_REDHAT
RHBZ#2483158 issue-tracking, x_refsource_REDHAT