← All Advisories

Red Hat Advanced Cluster Management Multicloud Subscription Component Lets a Namespace-Admin Tenant Abuse a Privileged ServiceAccount via Subscription CRs, Enabling a Confused-Deputy Attack Against Other Cluster Namespaces

Last refreshed2026-09-28

Status: NEW  |  Advisory ID: CVE-2026-72508

Key Details

CVECVE-2026-72508
CVSS Score / Version9.9 (Critical) / CVSS v3.1
Updated2026-08-27
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Classified asCWE-250 (Execution with Unnecessary Privileges)

What to Know

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster. (NVD)

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-72508
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-72508