Skip to content
fr Sign in
9.9 Critical

CVE-2026-72526 A flaw was found in the multicloud-integrations component

Description

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787260689 earliest → < 1787260689 1787260689
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259106 earliest → < 1787259106 1787259106
Red Hat Advanced Cluster Management for Kubernetes 2.14 1787183407 earliest → < 1787183407 1787183407
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238604 earliest → < 1787238604 1787238604
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787252179 earliest → < 1787252179 1787252179
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787243221 earliest → < 1787243221 1787243221

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium
Track this CVE