Red Hat Advanced Cluster Management Confused-Deputy Privilege Escalation (multicloud-operators-subscription)

Technical Analysis

The vulnerability (CVSS 9.9) stems from insufficient scoping of permissions granted to the multicloud-operators-subscription controller's ServiceAccount, which operates with cluster-wide privileges when reconciling Subscription CRs. A tenant with only namespace-admin rights can craft a malicious Subscription CR that the controller processes using its own elevated SA, effectively laundering low-privilege access into cluster-admin-equivalent actions — a classic confused-deputy pattern in Kubernetes operator design. This allows deployment of arbitrary cluster-scoped resources (e.g., ClusterRoleBindings, privileged DaemonSets, or webhook configurations), resulting in privilege escalation and potential RCE across all nodes in the managed fleet. Organizations running AI agent orchestration, RAG pipelines, or LLM tool-execution workloads on RHACM-managed OpenShift/Kubernetes clusters are at direct risk: a compromised namespace could be used to escalate into the cluster hosting agent runtimes, exfiltrate API keys and model credentials stored as cluster secrets, or tamper with agent inference/tool-calling containers to inject malicious instructions or exfiltrate data.

Affected Systems

Red Hat Advanced Cluster Management (RHACM) for Kubernetes — multicloud-operators-subscription component; all versions prior to the patched release addressing CVE-2026-72508; deployments on OpenShift Container Platform and managed multi-cluster hub/spoke topologies using GitOps/Subscription-based application delivery.

Indicators of Compromise

• No specific file hashes, IPs, or domains published; detection should focus on anomalous Subscription CR creation events, unexpected ClusterRoleBinding or cluster-scoped resource creation originating from namespace-scoped service accounts, and unusual multicloud-operators-subscription controller activity in audit logs.

Remediation Steps

1. 1

   Apply vendor patch

   Upgrade Red Hat Advanced Cluster Management to the fixed version addressing CVE-2026-72508 as soon as it is released/available via Red Hat errata.

2. 2

   Restrict Subscription CR creation

   Apply admission control policies (OPA/Gatekeeper, Kyverno, or RBAC) to limit which namespaces/tenants can create Subscription CRs, and audit existing RBAC bindings granting namespace-admin roles.

3. 3

   Reduce ServiceAccount privilege scope

   Review and minimize the permissions granted to the multicloud-operators-subscription ServiceAccount; apply least-privilege RBAC and avoid cluster-wide bindings where namespace-scoped roles suffice.

4. 4

   Audit cluster-scoped resource changes

   Enable and review Kubernetes audit logs for creation of cluster-scoped resources (ClusterRoles, ClusterRoleBindings, CRDs) initiated by non-admin identities or the subscription controller.

5. 5

   Isolate AI agent workloads

   For clusters hosting AI agent runtimes, RAG pipelines, or LLM tool-execution services, enforce network and namespace isolation, rotate any secrets/API keys potentially exposed to the affected controller, and monitor for unauthorized access to agent credential stores.