CVE-2026-72508

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management (affected versions not specified)

Description A flaw in the multicloud-operators-subscription component allows a namespace-admin tenant to execute a confused-deputy attack. By creating Subscription Custom Resources (CRs), the tenant can leverage a highly privileged ServiceAccount (SA) to deploy arbitrary cluster-scoped resources. This process leads to privilege escalation and potential arbitrary code execution across the cluster. A confused-deputy attack occurs when a privileged entity is tricked by a less privileged entity into performing an action it is not authorized to do.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.