CVE-2026-72526
CriticalCVSS 9.9Summary
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters, forcing ArgoCD on spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation.
Risk Assessment
Potential takeover of managed clusters, leading to integrity and confidentiality breaches and privilege escalation.
Recommendation
Apply vendor patches for the multicloud-integrations component and restrict permissions to create Applications on the hub cluster.
Original NVD description (English source)
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.