CVE-2026-72526
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.
Severity
CRITICAL
CVSS score
9.9
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-12 02:16:38.200000
Last modified
2026-10-24 15:10:00.190000
View original CVE JSON
{
"id": "CVE-2026-72526",
"sourceIdentifier": "[email protected]",
"published": "2026-08-12T02:16:38.200",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters."
},
{
"lang": "es",
"value": "Se encontró un fallo en el componente multicloud-integrations. El controlador de propagación de aplicaciones procesa la anotación ’ocm-managed-cluster’ de un Recurso Personalizado de Aplicación (CR) sin la validación adecuada. Un inquilino con permisos para crear Aplicaciones en el clúster hub puede explotar esto para atacar clústeres gestionados arbitrarios. Esto puede forzar a ArgoCD en los clústeres spoke a sincronizar manifiestos controlados por el atacante, lo que lleva a la ejecución de código arbitrario o la escalada de privilegios en esos clústeres."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicloud-integrations-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.11::el9"
],
"versions": [
{
"version": "1787260689",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicloud-integrations-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"versions": [
{
"version": "1787259106",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicloud-integrations-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"versions": [
{
"version": "1787183407",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicloud-integrations-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"versions": [
{
"version": "1787238604",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicloud-integrations-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"versions": [
{
"version": "1787252179",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/multicloud-integrations-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.17::el9"
],
"versions": [
{
"version": "1787243221",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-12T12:38:01.194138Z",
"id": "CVE-2026-72526",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-441"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:60386",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60387",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60388",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60389",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60390",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60391",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-72526",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514227",
"source": "[email protected]"
}
]
}