CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-72526 — A flaw was found in the multicloud-integrations component. The Application propa...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attac

Analysis

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters. CVSS Score: 9.9. Published: 2026-08-12T02:16:38.200.

Indicators of Compromise (1)

CVE (1)
CVE-2026-72526
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 12, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

The Hacker News
LOWVulnerabilityNEW

Cyber Incident Disrupts Student Services at UT San Antonio

UT San Antonio has taken IT systems offline following a cyber incident, disrupting student registration and tuition payments days before term is due to resume

Infosecurity Magazine
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-75627 — Bastillion fails to properly validate request URI paths in its controller dispat...

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

CVE-2026-75627
NIST NVD