CVE-2026-72526

Name of the Vulnerable Software and Affected Versions multicloud-integrations (affected versions not specified)

Description A flaw exists in the multicloud-integrations component where the Application propagation controller fails to properly validate the ocm-managed-cluster annotation within an Application Custom Resource (CR). A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This allows the attacker to force ArgoCD on spoke clusters to synchronize malicious manifests, potentially resulting in privilege escalation or arbitrary code execution on those clusters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.