CVE-2026-72508: Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). The application-manager addon's ClusterRole grants apiGroups: resources: verbs: (plus nonResourceURLs:) and is bound to the application-manager ServiceAccount on every managed cluster via the addon framework. This wildcard RBAC is the root enabler for multiple confused-deputy attacks where a namespace-admin tenant can create Subscription CRs that deploy arbitrary cluster-scoped resources using this privileged SA. A least-privilege variant exists in addon/manifests/permission/role.yaml but is not used by default.
Upstream repo: https://github.com/stolostron/multicloud-operators-subscription Audited commit: 48ae4defaa5b719e0664e1de7413c96029c938bc Jira tracker: ACM-38624
Other sources
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72508?
CVE-2026-72508 has a critical severity rating of 9.9.
What risk does CVE-2026-72508 pose to users?
CVE-2026-72508 poses a risk level of 82, indicating high potential impact.
How do I remediate CVE-2026-72508?
To remediate CVE-2026-72508, ensure that appropriate Role-Based Access Control (RBAC) policies are configured to limit ServiceAccount permissions.
Who is affected by CVE-2026-72508?
CVE-2026-72508 affects users of the Red Hat Advanced Cluster Management (RHACM) who utilize namespace-admin roles.
What kind of attack does CVE-2026-72508 facilitate?
CVE-2026-72508 facilitates a confused-deputy attack through misuse of privileged ServiceAccounts.