EUVD-2026-57529
GHSA-hr6f-38vx-3c48
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Reachable via Kubernetes API (AV:N), low-complexity confused-deputy abuse by an existing namespace-admin (PR:L), crossing the namespace-to-cluster trust boundary (S:C) with full CIA impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.
AnalysisAI
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker who already holds namespace-admin (tenant-level) rights in an RHACM 2.x deployment where the multicloud-operators-subscription controller is active and reconciles Subscription CRs with a highly privileged, cluster-scoped ServiceAccount - i.e., a multi-tenant hub where namespace admins can create Subscription Custom Resources. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) reflects network-reachable exploitation over the Kubernetes API, low attacker complexity, only low privileges (an existing namespace-admin tenant), no user interaction, and a scope change that carries impact from one namespace to the whole cluster - consistent with the confused-deputy escalation described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A tenant granted namespace-admin on a shared RHACM-managed cluster authors a Subscription CR pointing at attacker-controlled content that defines cluster-scoped objects (for example a ClusterRoleBinding granting cluster-admin, or a privileged workload). The multicloud-operators-subscription controller reconciles it using its high-privilege ServiceAccount and creates those resources cluster-wide, giving the tenant escalated rights and a path to arbitrary code execution across the fleet. … |
| Remediation | No vendor-released patch identified at time of analysis - the provided references (the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-72508 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2514225) do not include an exact fixed version, so monitor the Red Hat advisory and apply the errata RPM/operator update as soon as it is published, citing the fixed version stated there rather than an assumed one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all deployments of Red Hat Advanced Cluster Management version 2 in your environment, document multi-tenant isolation scope, and audit which accounts have namespace-admin privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today