CVE-2026-72508

This CVE exposes a confused-deputy vulnerability in multi-cluster subscription operators where a namespace-scoped Custom Resource triggers cluster-scoped privilege escalation through an authorized operator. The core issue is not a code defect but an architectural consequence: the Subscription operator must run with a privileged ServiceAccount to function across clusters, and nothing in the Subscription CR API constrains which resource types it can deploy. A namespace-admin creating a Subscription isn't attempting privilege escalation — they're using the tool as designed. The attack surface emerges from the gap between the operator's intended scope (deploying applications) and its actual capability (deploying anything, including cluster-scoped resources that alter security policy). This is not a novel mutation in the vulnerability genome. Prior CVEs — CVE-2021-25742 and CVE-2020-10749 — established exactly this attack vector and recommended least-privilege operator SAs and resource-type allowlists as remediation. The pattern resurfaced because those recommendations were absorbed into the ecosystem as accepted risk rather than eliminated. The multi-cluster topology compounds the blast radius: in hub-spoke configurations, compromising the subscription operator's SA can grant access to cluster-scoped resources across the entire managed fleet, not just a single cluster. What you should do: First, audit which ServiceAccount your subscription operator runs under and whether it has cluster-wide privileges. Second, implement an admission policy — OPA/Gatekeeper or a validating webhook — that blocks Subscription resources from specifying cluster-scoped resource types unless explicitly authorized. Third, consider whether the operator can be refactored to use tenant-scoped ServiceAccounts rather than a shared privileged one, even if it complicates deployment workflows. The fix must address the abstraction layer; RBAC alone cannot solve this because the namespace-admin isn't exercising their own permissions — they're routing through an authorized deputy. The community should treat this CVE as evidence that the pattern of ergonomic multi-cluster abstractions creating predictable confused-deputy attack surface must be addressed at the design level, not patched instance by instance.

Reviewed through automated stages and approved by a human before publication.