CVE-2026-72508

Awaiting Analysis Awaiting Analysis - Queue

Confused Deputy Attack in Red Hat Advanced Cluster Management

Publication date: 2026-08-12

Last updated on: 2026-08-27

Assigner: redhat-SADP

Description

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-27

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72508

EUVD

EUVD-2026-57529

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	advanced_cluster_management	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-250	The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

Executive Summary

CVE-2026-72508 is a privilege escalation flaw in Red Hat Advanced Cluster Management (RHACM). It allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that use a highly privileged ServiceAccount. This grants the tenant permission to deploy arbitrary cluster-scoped resources, enabling privilege escalation and potential arbitrary code execution across the cluster.

Detection Guidance

To detect this vulnerability, check for Subscription Custom Resources (CRs) created by namespace-admin tenants that may deploy arbitrary cluster-scoped resources. Inspect the application-manager ServiceAccount's permissions for wildcard RBAC configurations. Use commands like 'kubectl get subscriptions -A' to list CRs and 'kubectl get clusterrolebinding -o yaml' to review excessive permissions.

Impact Analysis

An attacker with namespace-admin access could exploit this to deploy malicious cluster-scoped resources, leading to full cluster compromise. This includes unauthorized data access, system modifications, or denial-of-service attacks. The high CVSS score (9.9) indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using RHACM must address this flaw to maintain compliance with these regulations.

Mitigation Strategies

Configure the application-manager addon to use a least-privilege RBAC variant by applying the addon/manifests/permission/role.yaml configuration to restrict the ServiceAccount's permissions.
Restart or reload affected components after applying the RBAC changes to ensure the new permissions take effect.

Hi! I’m here to help you understand CVE-2026-72508. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70