CVE-2026-72508: RHACM Privilege Escalation Vulnerability

CVE-2026-72508 Overview

CVE-2026-72508 is a confused deputy vulnerability in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A namespace-admin tenant can craft Subscription Custom Resources (CRs) that abuse a highly privileged ServiceAccount to deploy arbitrary cluster-scoped resources. The flaw enables privilege escalation from a restricted tenant scope to full cluster control. Exploitation can lead to arbitrary code execution across managed Kubernetes clusters. The weakness maps to [CWE-250] (Execution with Unnecessary Privileges).

Critical Impact
A namespace-scoped tenant can escalate to cluster-wide privileges and deploy arbitrary resources through abuse of a privileged subscription ServiceAccount.

Affected Products

Red Hat Advanced Cluster Management for Kubernetes (RHACM)
multicloud-operators-subscription component
Managed OpenShift and Kubernetes clusters operated through RHACM

Discovery Timeline

2026-08-12 - CVE CVE-2026-72508 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72508

Vulnerability Analysis

The multicloud-operators-subscription controller reconciles Subscription CRs that describe application content to deploy across managed clusters. The controller executes these reconciliations using a ServiceAccount that holds cluster-scoped permissions well beyond the tenant's namespace boundary. When a namespace-admin submits a Subscription CR, the controller acts on the tenant's behalf but with its own elevated identity. This mismatch between the requester's authority and the executor's authority is the classic confused deputy pattern.

The result is a full tenant-to-cluster privilege escalation path. An attacker with only namespace-admin rights can instruct the controller to create, modify, or delete cluster-scoped resources such as ClusterRoles, ClusterRoleBindings, CustomResourceDefinitions, and Namespaces. Arbitrary workloads can then be scheduled anywhere in the cluster, enabling code execution on nodes and lateral movement across tenants.

Root Cause

The root cause is execution with unnecessary privileges [CWE-250]. The subscription controller does not constrain the effective permissions applied when processing a tenant-submitted Subscription CR to the tenant's own RBAC scope. Instead, the controller's own high-privilege ServiceAccount is used to perform every action described by the CR, without impersonation or scoped validation against the submitter's identity.

Attack Vector

The attack requires only network access to the Kubernetes API and namespace-admin credentials within a single tenant namespace. The attacker creates a malicious Subscription CR that references cluster-scoped manifests or points to a git or Helm source containing them. The controller reconciles the resource and applies the manifests using its privileged ServiceAccount. No user interaction and no additional authentication are required. See the Red Hat CVE-2026-72508 Advisory and Red Hat Bugzilla Report #2514225 for vendor-confirmed technical details.

Detection Methods for CVE-2026-72508

Indicators of Compromise

Subscription CRs created in tenant namespaces that reference cluster-scoped resource kinds such as ClusterRole, ClusterRoleBinding, CustomResourceDefinition, or Namespace.
Kubernetes audit log entries showing the multicloud-operators-subscription ServiceAccount creating cluster-scoped objects immediately after a tenant-authored Subscription is applied.
Unexpected ClusterRoleBindings that grant cluster-admin or wildcard verbs to tenant-controlled subjects.
New workloads scheduled outside the submitting tenant's namespace shortly after Subscription reconciliation events.

Detection Strategies

Enable Kubernetes API server audit logging at RequestResponse level for Subscription CRs and correlate user.username on the request with the ServiceAccount that performs downstream writes.
Alert on any write to cluster-scoped RBAC resources sourced from the subscription controller ServiceAccount when triggered by a namespace-admin identity.
Use admission controllers such as Kyverno or OPA Gatekeeper to inspect Subscription CR payloads for cluster-scoped manifests.

Monitoring Recommendations

Centralize Kubernetes and RHACM audit logs and retain them for correlation with tenant activity.
Monitor for anomalous creation rates of ClusterRoles, ClusterRoleBindings, and CRDs across managed clusters.
Track ServiceAccount token usage for multicloud-operators-subscription and alert on privilege boundary crossings between tenant and cluster scopes.

How to Mitigate CVE-2026-72508

Immediate Actions Required

Apply the fixed RHACM release when published by Red Hat as tracked in the Red Hat CVE-2026-72508 Advisory.
Audit existing Subscription CRs across all tenant namespaces for references to cluster-scoped resources or untrusted external sources.
Rotate ServiceAccount tokens associated with the subscription controller after patching.
Review recent creations of ClusterRoles, ClusterRoleBindings, and CRDs to identify prior abuse.

Patch Information

Red Hat tracks remediation in the Red Hat CVE-2026-72508 Advisory and Red Hat Bugzilla Report #2514225. Consult these references for fixed component versions and errata identifiers as they are released. Apply updates to both the RHACM hub cluster and all managed clusters running the affected multicloud-operators-subscription component.

Workarounds

Restrict who can create Subscription CRs by removing the subscriptions.apps.open-cluster-management.io create verb from namespace-admin roles until patched.
Deploy an admission policy that rejects Subscription CRs whose referenced manifests contain cluster-scoped kinds.
Limit tenant namespaces to trusted git and Helm sources through channel allowlisting in RHACM.
Segment sensitive workloads onto separate managed clusters to reduce blast radius from a compromised tenant.

bash

# Example Kyverno policy to block cluster-scoped kinds in Subscription CRs
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-cluster-scoped-in-subscriptions
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-clusterrole-refs
      match:
        any:
          - resources:
              kinds:
                - apps.open-cluster-management.io/v1/Subscription
      validate:
        message: "Subscription CRs must not reference cluster-scoped resources."
        deny:
          conditions:
            any:
              - key: "{{ request.object.spec.packageOverrides[].packageName }}"
                operator: AnyIn
                value:
                  - ClusterRole
                  - ClusterRoleBinding
                  - CustomResourceDefinition
                  - Namespace