by Kastro CVE-2026-72508
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 — Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)
Description · from the CVE record
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.
Affected
ProductAffectedFixed inSource
Red Hat Advanced Cluster Management for Kubernetes 2.11see advisory1787263584CNA
Red Hat Advanced Cluster Management for Kubernetes 2.13see advisory1787263693CNA
Red Hat Advanced Cluster Management for Kubernetes 2.14see advisory1787170830CNA
Red Hat Advanced Cluster Management for Kubernetes 2.15see advisory1787240030CNA
Red Hat Advanced Cluster Management for Kubernetes 2.16see advisory1787242321CNA
Red Hat Advanced Cluster Management for Kubernetes 2.17see advisory1787242108CNA
Scores by source
redhat (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total