CVE-2026-72526 Overview
CVE-2026-72526 is a critical vulnerability in the multicloud-integrations component used in Red Hat Advanced Cluster Management environments. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can target arbitrary managed (spoke) clusters. Successful exploitation forces ArgoCD on spoke clusters to synchronize attacker-controlled manifests, resulting in arbitrary code execution or privilege escalation across managed clusters. The flaw is classified under [CWE-441] Unintended Proxy or Intermediary (Confused Deputy).
Critical Impact
A low-privileged tenant on the hub cluster can pivot to any managed spoke cluster and execute arbitrary code or escalate privileges by injecting malicious Kubernetes manifests through ArgoCD synchronization.
Affected Products
- Red Hat Advanced Cluster Management multicloud-integrations component
- Open Cluster Management Application propagation controller
- ArgoCD deployments managed through the affected controller on spoke clusters
Discovery Timeline
- 2026-08-12 - CVE-2026-72526 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-72526
Vulnerability Analysis
The vulnerability resides in the Application propagation controller within the multicloud-integrations component. The controller reads the ocm-managed-cluster annotation from Application Custom Resources submitted on the hub cluster. It then propagates the referenced manifests to the ArgoCD instance running on the target managed cluster.
The controller does not validate whether the requesting tenant has authorization to target the cluster referenced in the annotation. This creates a confused deputy condition. Any tenant permitted to create Applications on the hub can specify an arbitrary spoke cluster in the annotation. The controller acts on the tenant's behalf with its own elevated propagation privileges, bypassing tenant-scoped access boundaries.
Because ArgoCD on spoke clusters treats propagated manifests as authoritative sources, attacker-supplied content is synchronized directly into the target cluster. This can deploy privileged workloads, mount host paths, or create ServiceAccounts with cluster-admin bindings.
Root Cause
The root cause is missing tenant-to-cluster authorization enforcement on annotation-supplied targets. The controller trusts the ocm-managed-cluster annotation without cross-referencing tenant RBAC scope against the target cluster. This is a classic [CWE-441] Unintended Proxy or Intermediary flaw where a privileged intermediary performs actions on behalf of an unauthorized principal.
Attack Vector
The attack is network-based and requires low privileges: only the ability to create Application resources on the hub cluster. No user interaction is required, and the scope is changed because impact extends beyond the hub into separate managed clusters.
An attacker with hub Application-create permissions crafts an Application CR containing the ocm-managed-cluster annotation pointing at a target spoke cluster. The Application source references a repository or manifest containing malicious Kubernetes resources, such as a privileged DaemonSet, a pod with hostPath mounts, or a ClusterRoleBinding granting cluster-admin. The propagation controller forwards the manifest to the target cluster's ArgoCD instance, which synchronizes the workload with its own service account privileges, yielding code execution on the spoke.
Detection Methods for CVE-2026-72526
Indicators of Compromise
- Application Custom Resources on the hub cluster containing ocm-managed-cluster annotations that reference clusters outside the submitting tenant's authorized scope.
- ArgoCD sync events on spoke clusters that originate from Application definitions the local cluster tenants did not author.
- Newly created privileged workloads on spoke clusters, particularly DaemonSets, pods with hostPath or hostNetwork, or ClusterRoleBindings referencing cluster-admin.
Detection Strategies
- Audit hub cluster Kubernetes API logs for create and update verbs on applications.argoproj.io and correlate the ocm-managed-cluster annotation value with the submitter's authorized cluster set.
- Compare ArgoCD Application source repositories against an allowlist of approved Git sources per tenant.
- Monitor spoke cluster admission controller events for high-risk manifests synchronized by ArgoCD service accounts shortly after hub Application changes.
Monitoring Recommendations
- Enable Kubernetes audit logging on the hub cluster at RequestResponse level for Application resources and forward events to a centralized SIEM.
- Alert on any Application resource whose annotation-declared target cluster does not match the namespace ownership or tenant boundary policy.
- Track ArgoCD controller reconciliation logs on spoke clusters for unexpected source repositories or manifest hashes.
How to Mitigate CVE-2026-72526
Immediate Actions Required
- Restrict create and update permissions on applications.argoproj.io resources at the hub cluster to trusted operators only.
- Inventory all existing Application CRs and validate their ocm-managed-cluster annotations against expected tenant-to-cluster mappings.
- Apply Red Hat security updates for the multicloud-integrations component as soon as they are available.
Patch Information
Consult the Red Hat CVE-2026-72526 Advisory and Red Hat Bugzilla Report #2514227 for the fixed component versions and errata applicable to your Red Hat Advanced Cluster Management deployment. Apply vendor-provided updates on the hub cluster and verify that the propagation controller enforces tenant-scoped cluster authorization after upgrade.
Workarounds
- Use Kubernetes RBAC and admission policies (OPA Gatekeeper or Kyverno) on the hub cluster to reject Application CRs whose ocm-managed-cluster annotation references clusters outside the submitting tenant's scope.
- Enforce namespace-scoped Application creation and disable cluster-wide Application submission for tenant service accounts.
- Restrict ArgoCD source repositories on spoke clusters to a curated allowlist, preventing unknown Git sources from synchronizing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
