CVE-2026-72508

CriticalCVSS 9.9

Published: 12/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Summary

A flaw in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM) allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources that leverage a highly privileged ServiceAccount.

Risk Assessment

The tenant can deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

Recommendation

Restrict permissions to create Subscription resources and monitor the use of highly privileged ServiceAccounts.

Original NVD description (English source)

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.