CVE-2026-72508: Execution with Unnecessary Privileges in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability CVE-2026-72508 affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2.11. It enables a namespace-admin tenant to exploit a confused-deputy attack by creating Subscription Custom Resources that utilize a highly privileged ServiceAccount. This misuse allows the tenant to deploy arbitrary cluster-scoped resources, resulting in privilege escalation and potential arbitrary code execution within the Kubernetes cluster. The CVSS v3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges at the level of a namespace admin, no user interaction, and high impact on confidentiality, integrity, and availability. Red Hat has issued security advisories (RHSA-2026:60387 and RHSA-2026:60386) with updated container images and security fixes in newer releases such as version 2.17.1. The advisories recommend applying these updates and ensuring all prior errata are applied. No known exploits in the wild have been reported at this time.

An attacker with namespace-admin privileges can exploit this vulnerability to escalate privileges to cluster-admin level by deploying arbitrary cluster-scoped resources. This can lead to full compromise of the Kubernetes cluster, including arbitrary code execution, data exposure, and disruption of cluster operations. The vulnerability affects confidentiality, integrity, and availability of the cluster.

Red Hat has released security updates and updated container images in versions later than 2.11, including 2.17.1, which address this vulnerability. Users should apply these official updates as per Red Hat's guidance and ensure all previously released relevant errata are applied. Detailed update instructions are available from Red Hat's official documentation. There is no indication that the vulnerability is mitigated without applying these updates. No specific temporary workarounds are provided in the advisory.