CVE-2026-72526: Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72526?
The severity of CVE-2026-72526 is critical with a score of 9.9.
How does CVE-2026-72526 affect multicloud-integrations?
CVE-2026-72526 allows a hub tenant with appropriate permissions to exploit an unvalidated annotation to target arbitrary spoke clusters.
What can an attacker achieve by exploiting CVE-2026-72526?
An attacker can potentially gain unauthorized access and control over arbitrary spoke clusters due to the flawed propagation mechanism.
How do I fix CVE-2026-72526?
To fix CVE-2026-72526, ensure that proper validation is implemented for the `ocm-managed-cluster` annotation in the Application propagation controller.
What are the impacts of CVE-2026-72526 on system security?
CVE-2026-72526 poses a high risk to system security by allowing unauthorized actions on critical components in a multicloud environment.