Red Hat ACM Fixes Five Critical Flaws, Including CVE-2026-72526 RCE Bug (CVSS 9.9)

Red Hat patched five critical bugs in Advanced Cluster Management this week. Two of them allow RHACM remote code execution on managed clusters. Both score a 9.9 on the CVSS scale. The other three flaws leak tokens or escalate access, with scores from 9.6 to 9.9. So, admins should patch now.

Notable CVEs

Why It Matters

These bugs hit the core of Kubernetes fleet management. RHACM runs thousands of spoke clusters from one hub. So, a single hub bug becomes a risk for the whole fleet. An attacker with basic tenant access could steal tokens, hijack GitOps deployments, or run jobs as an admin. That path to RHACM remote code execution turns a small foothold into full control. Because of this, multi-tenant RHACM setups face the highest risk.

How the Attacks Work

Token Theft via GitOpsCluster (CVE-2026-70398)

The GitOpsCluster controller stores spoke cluster tokens in a safe spot. A tenant can redirect that write to a namespace of their own instead. Then they read the tokens directly. Red Hat’s advisory confirms this also skips ArgoCD AppProject checks.

Manifest Hijacking (CVE-2026-72526)

The Application propagation controller trusts a cluster-name field without checking it first. So, a tenant who can create Applications on the hub can target any spoke cluster. ArgoCD then syncs manifests the attacker controls. Red Hat’s bulletin confirms this leads to arbitrary code execution.

Cluster-Wide Access via ClusterCurator (CVE-2026-73269)

A local user can create a ClusterCurator resource with a mismatched name and namespace. The controller then builds a cluster-wide ClusterRoleBinding in response. As a result, that user jumps straight to cluster-wide control, Red Hat notes.

Job Injection (CVE-2026-73268)

The CreateJob function skips a key validation step. It never checks the spec.install.overrideJob field before use. So, a tenant with update rights on ClusterCurator can inject a custom Job. That Job then runs with the controller’s own high-level access. Red Hat’s report warns this exposes cluster-wide secrets.

Confused Deputy in Subscriptions (CVE-2026-72508)

The application-manager addon carries broad wildcard rights by default. Because of that, a namespace admin can create a Subscription resource that abuses this access. They can then deploy cluster-scoped resources far outside their own namespace. Red Hat’s statement calls this a confused-deputy attack.

Affected Versions

These flaws affect Red Hat Advanced Cluster Management and the standalone Multicluster Engine. Both run inside many OpenShift setups. Red Hat has not shared install counts for either product. Still, no source confirms active attacks. And no public proof-of-concept exists for any of the five bugs today.

Patch and Mitigation Steps

Red Hat shipped fixed builds for all five bugs. So, patching remains the safest fix. If you cannot patch right away, try these steps instead:

• Match ClusterCurator metadata.name to metadata.namespace
• Limit create and update rights on ClusterCurator to trusted admins
• Apply the least-privilege RBAC role for the application-manager addon
• Check GitOpsCluster secrets for tokens outside their expected namespace

Even without confirmed attacks, a CVSS score up to 9.9 makes patching worth it. Fixing these bugs now closes off the RHACM remote code execution risk for good.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.