What is the CVSS score of EUVD-2026-57529?

EUVD-2026-57529 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Red Hat ACM are affected by EUVD-2026-57529?

Red Hat Advanced Cluster Management for Kubernetes 2 contains a critical privilege escalation vulnerability that allows namespace administrators to bypass tenant isolation controls and execute…

How to fix or mitigate EUVD-2026-57529?

Within 24 hours: identify all deployments of Red Hat Advanced Cluster Management version 2 in your environment, document multi-tenant isolation scope, and audit which accounts have namespace-admin privileges. Within 7 days: apply restrictive RBAC policies to the multicloud-operators-subscription controller ServiceAccount to limit it to documented minimum permissions, implement audit logging for Subscription Custom Resource creation and modification, and restrict which namespaces can create these resources. Within 30 days: monitor Red Hat Security Advisories for patch release; when available, validate the patch in non-production clusters and plan production upgrade timelines.

Red Hat ACM EUVD-2026-57529

| CVE-2026-72508 CRITICAL

Execution with Unnecessary Privileges (CWE-250)

2026-08-12 redhat

GHSA-hr6f-38vx-3c48

Privilege Escalation RCE Red Hat Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

9.9

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Reachable via Kubernetes API (AV:N), low-complexity confused-deputy abuse by an existing namespace-admin (PR:L), crossing the namespace-to-cluster trust boundary (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.9 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:22 vuln.today

CVE Published

Aug 12, 2026 - 19:41 nvd

CRITICAL 9.9

DescriptionCVE.org

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

AnalysisAI

Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).

Technical ContextAI

RHACM manages the lifecycle of applications across fleets of OpenShift/Kubernetes clusters. Its multicloud-operators-subscription component watches Subscription CRs and reconciles the referenced content (Helm charts, Git/objectbucket channels) into the cluster, acting on behalf of a controller ServiceAccount that holds broad, often cluster-scoped RBAC permissions. The root cause is CWE-250 (Execution with Unnecessary Privileges): the controller performs deployment work using its own elevated SA rather than the requesting tenant's constrained identity, so it does not adequately confine what a low-privileged Subscription author can cause it to create. Because the tenant controls the Subscription content but the controller supplies the privileges, any namespace-admin effectively borrows the controller's authority - a classic confused-deputy pattern against the Kubernetes RBAC boundary. The affected software is identified by CPE cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2.

RemediationAI

No vendor-released patch identified at time of analysis - the provided references (the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-72508 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2514225) do not include an exact fixed version, so monitor the Red Hat advisory and apply the errata RPM/operator update as soon as it is published, citing the fixed version stated there rather than an assumed one. In the interim, reduce blast radius with concrete compensating controls: restrict who can create or modify Subscription CRs by tightening RBAC so untrusted tenants lack namespace-admin over namespaces where the subscription controller reconciles (trade-off: may block legitimate self-service application deployment); constrain the cluster-scoped resource types the subscription flow can create using admission policy (OPA/Gatekeeper or Kubernetes ValidationAdmissionPolicy) to deny tenant-authored cluster-scoped objects (trade-off: can break valid cluster-scoped app content and needs per-environment tuning); and audit existing Subscription CRs and the controller ServiceAccount's RBAC bindings for evidence of abuse or over-broad grants. Treat multi-tenant RHACM hubs as highest priority for these controls until the official patch is applied.