CVE-2026-72508

CVSS 9.9 (critical) · published 2026-08-12

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

Weakness: CWE-250

Source: NVD CVE-2026-72508

References

• https://access.redhat.com/errata/RHSA-2026:60386
• https://access.redhat.com/errata/RHSA-2026:60387
• https://access.redhat.com/errata/RHSA-2026:60388
• https://access.redhat.com/errata/RHSA-2026:60389
• https://access.redhat.com/errata/RHSA-2026:60390
• https://access.redhat.com/errata/RHSA-2026:60391
• https://access.redhat.com/security/cve/CVE-2026-72508
• https://bugzilla.redhat.com/show_bug.cgi?id=2514225

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.