Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-72526

Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

Default version status: affected

  • 1787260689 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13

Default version status: affected

  • 1787259106 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14

Default version status: affected

  • 1787183407 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

Default version status: affected

  • 1787238604 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Default version status: affected

  • 1787252179 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

Default version status: affected

  • 1787243221 to < *unaffected

References