Security readout for executives and security teams
Plain-English summary
A hub-cluster tenant who can create Applications may redirect deployment content to managed clusters they should not control. Argo CD could then deploy attacker-controlled manifests, potentially enabling code execution, privilege escalation, data compromise, or service disruption across spoke clusters.
Executive priority
Treat this as an urgent cross-cluster authorization issue. Identify affected hubs immediately, constrain tenant Application permissions, and schedule vendor-directed remediation at the earliest safe change window. Prioritize shared or externally administered hubs and spokes where Argo CD holds elevated privileges.
Technical view
The multicloud-integrations propagation controller trusts the Application CR's `ocm-managed-cluster` annotation without adequate validation. This authorization-boundary failure, classified as CWE-441, lets a low-privileged hub tenant select an arbitrary managed cluster and induce its Argo CD instance to synchronize attacker-controlled manifests.
Likely exposure
Exposure requires Red Hat Advanced Cluster Management 2.11 through 2.17 with an affected multicloud-integrations build, pull-model propagation, and a tenant permitted to create Application resources on the hub. Risk increases when multiple tenants share the hub or Argo CD on spokes has broad deployment privileges.
Exploitation context
The supplied sources do not report known active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation nevertheless has low stated complexity and requires an authenticated tenant with Application-creation permission, not an unauthenticated internet user.
Researcher notes
The weakness crosses the hub-to-spoke trust boundary: attacker-controlled metadata influences the destination cluster without sufficient authorization validation. Assessment should focus on annotation validation, tenant-to-cluster authorization, propagation-controller behavior, and Argo CD permissions. Fixed build numbers and technical patch details are not present in the supplied bundle.
Mitigation direction
- Review the applicable Red Hat erratum and apply its vendor-supported update or remediation guidance promptly.
- Restrict Application creation on the hub to trusted identities until vendor remediation is confirmed.
- Review RBAC bindings granting Application creation and remove unnecessary tenant permissions.
- Limit Argo CD service-account privileges on spoke clusters using least privilege.
Validation and detection
- Inventory ACM versions and multicloud-integrations package build identifiers across every hub.
- Compare installed builds with the affected identifiers and applicable Red Hat errata.
- Verify which identities can create or modify Application resources on each hub.
- Review Applications for unexpected `ocm-managed-cluster` annotations or unauthorized spoke targets.
- Examine hub and spoke audit records for suspicious propagation or Argo CD synchronization activity.
- After remediation, confirm Red Hat's corrected package is installed on every affected hub.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-441: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-72526 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16redhatVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:60386CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60387CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60388CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60389CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60390CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60391CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-72526CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2514227CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unintended Proxy or Intermediary ('Confused Deputy')
Unintended Proxy or Intermediary ('Confused Deputy') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.