https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T06:40:04.346854+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-72508 CVE-2026-72508 — Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard r… 2026-10-06T06:40:04.363356+00:00

Affected: Red Hat Advanced Cluster Management for Kubernetes 2.11, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat Advanced Cluster Management for Kubernetes 2.17

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.