CVE-2026-72526

Summary: CVE-2026-72526 concerns the multicloud-integrations component where the Application propagation controller mishandles the ocm-managed-cluster annotation from an Application CR without sufficient validation. This allows a hub-cluster tenant with permission to create Applications to target...

CVE-2026-72526 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...