CVE-2026-72508
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.
Severity
CRITICAL
CVSS score
9.9
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-12 20:17:49.650000
Last modified
2026-10-24 15:10:00.190000
View original CVE JSON
{
"id": "CVE-2026-72508",
"sourceIdentifier": "[email protected]",
"published": "2026-08-12T20:17:49.650",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster."
},
{
"lang": "es",
"value": "Se encontró una falla en el componente multicloud-operators-subscription de Red Hat Advanced Cluster Management (RHACM). Esta vulnerabilidad permite a un inquilino administrador de espacio de nombres realizar un ataque de delegado confuso mediante la creación de Recursos Personalizados de Suscripción (CRs) que aprovechan una ServiceAccount (SA) con altos privilegios. Esto permite al inquilino desplegar recursos con ámbito de clúster arbitrarios, lo que lleva a la escalada de privilegios y a una potencial ejecución de código arbitrario en todo el clúster."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicluster-operators-subscription-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.11::el9"
],
"versions": [
{
"version": "1787263584",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicluster-operators-subscription-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"versions": [
{
"version": "1787263693",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicluster-operators-subscription-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"versions": [
{
"version": "1787170830",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicluster-operators-subscription-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"versions": [
{
"version": "1787240030",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicluster-operators-subscription-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"versions": [
{
"version": "1787242321",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicluster-operators-subscription-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.17::el9"
],
"versions": [
{
"version": "1787242108",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T14:15:53.219688Z",
"id": "CVE-2026-72508",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-250"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:60386",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60387",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60388",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60389",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60390",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60391",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-72508",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514225",
"source": "[email protected]"
}
]
}