Skip to content
Sign in
9.9 Critical

CVE-2026-72526 A flaw was found in the multicloud-integrations component

Description

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787260689 earliest → < 1787260689 1787260689
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259106 earliest → < 1787259106 1787259106
Red Hat Advanced Cluster Management for Kubernetes 2.14 1787183407 earliest → < 1787183407 1787183407
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238604 earliest → < 1787238604 1787238604
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787252179 earliest → < 1787252179 1787252179
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787243221 earliest → < 1787243221 1787243221

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 122 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-123037 Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) 6.7 Medium CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High
Track this CVE