What’s Vulnerable › Vulnerabilities

CVE-2026-72526: Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-10-24
• Weakness: CWE-441

Description

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.

Affected products

• Red Hat Advanced Cluster Management for Kubernetes 2.11: all versions — fixed in 1787260689
• Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1787259106
• Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1787183407
• Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1787238604
• Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1787252179
• Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787243221

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.11 1787260689; Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259106; Red Hat Advanced Cluster Management for Kubernetes 2.14 1787183407; Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238604; Red Hat Advanced Cluster Management for Kubernetes 2.16 1787252179; Red Hat Advanced Cluster Management for Kubernetes 2.17 1787243221. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:60386
• https://access.redhat.com/errata/RHSA-2026:60387
• https://access.redhat.com/errata/RHSA-2026:60388
• https://access.redhat.com/errata/RHSA-2026:60389
• https://access.redhat.com/errata/RHSA-2026:60390
• https://access.redhat.com/errata/RHSA-2026:60391
• https://access.redhat.com/security/cve/CVE-2026-72526
• https://bugzilla.redhat.com/show_bug.cgi?id=2514227

Get alerted when CVE-2026-72526 or the next vulnerability affects your stack