CVE-2026-72526

CriticalCVSS 9.9

Published: 12/08/2026(UTC)Updated: 27/08/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

35th percentile - higher than 35% of all known CVEs

Summary

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters, forcing ArgoCD on spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation.

Risk Assessment

Potential takeover of managed clusters, leading to integrity and confidentiality breaches and privilege escalation.

Recommendation

Apply vendor patches for the multicloud-integrations component and restrict permissions to create Applications on the hub cluster.

Other vulnerabilities in multicloud-integrations

CVE-2026-70398Critical
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user (tenant) to manipulate the GitOpsCluster controller, redirecting sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This can lead to disclosure of critical information and bypass of security policies within ArgoCD AppProjects.

Original NVD description (English source)

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS