CVE-2026-72508

Published: Aug 12, 2026Modified: Aug 27, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

Related CWEs

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (8)

https://access.redhat.com/errata/RHSA-2026:60386

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60387

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60388

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60389

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60390

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60391

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-72508

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2514225

Source: secalert@redhat.com

Timeline

No history available yet.