ArgoCD Multicloud Integrations Vulnerability in Red Hat Products
CVE-2026-72526

9.9CRITICAL

Key Information:

Vendor

Red Hat
Status
Red Hat Advanced Cluster Management For Kubernetes 2
Vendor
CVE Published:
12 August 2026

What is CVE-2026-72526?

A flaw exists in the multicloud-integrations component of ArgoCD whereby the Application propagation controller inadequately validates the ocm-managed-cluster annotation from an Application Custom Resource (CR). This vulnerability enables individuals with permission to create Applications on the hub cluster to exploit the system by targeting arbitrary managed clusters. Consequently, attackers can manipulate ArgoCD on spoke clusters to synchronize manipulated manifests, which may lead to arbitrary code execution or privilege escalation, significantly compromising cluster security.

References

https://access.redhat.com/security/cve/CVE-2026-72526
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2514227
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.