CVE-2026-72526: Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation
A flaw was found in the multicloud-integrations component of Red Hat Advanced Cluster Management (RHACM). The Application propagation controller takes the tenant-controlled ocm-managed-cluster annotation verbatim from an Application CR and uses it as the ManifestWork namespace without authorization checks. The only validation is a bare existence check on the target ManagedCluster. A tenant with Application create permissions in any hub namespace can generate ManifestWorks targeting arbitrary managed clusters, resulting in spoke cluster-admin ArgoCD syncing attacker-controlled manifests.
Upstream repo: https://github.com/stolostron/multicloud-integrations Audited commit: d88a168 Jira tracker: ACM-38643
Other sources
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72526?
The severity of CVE-2026-72526 is critical with a score of 9.9.
How does CVE-2026-72526 affect multicloud-integrations?
CVE-2026-72526 allows a hub tenant with appropriate permissions to exploit an unvalidated annotation to target arbitrary spoke clusters.
What can an attacker achieve by exploiting CVE-2026-72526?
An attacker can potentially gain unauthorized access and control over arbitrary spoke clusters due to the flawed propagation mechanism.
How do I fix CVE-2026-72526?
To fix CVE-2026-72526, ensure that proper validation is implemented for the `ocm-managed-cluster` annotation in the Application propagation controller.
What are the impacts of CVE-2026-72526 on system security?
CVE-2026-72526 poses a high risk to system security by allowing unauthorized actions on critical components in a multicloud environment.