by Kastro CVE-2026-72526
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 — Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation
Description · from the CVE record
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.
Affected
ProductAffectedFixed inSource
Red Hat Advanced Cluster Management for Kubernetes 2.11see advisory1787260689CNA
Red Hat Advanced Cluster Management for Kubernetes 2.13see advisory1787259106CNA
Red Hat Advanced Cluster Management for Kubernetes 2.14see advisory1787183407CNA
Red Hat Advanced Cluster Management for Kubernetes 2.15see advisory1787238604CNA
Red Hat Advanced Cluster Management for Kubernetes 2.16see advisory1787252179CNA
Red Hat Advanced Cluster Management for Kubernetes 2.17see advisory1787243221CNA
Scores by source
redhat (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total