CVE-2026-72526

CVE-2026-72526 is a vulnerability found within the `multicloud-integrations` component, specifically affecting the Application propagation controller. This flaw arises because the controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without adequate validation. This lack of validation enables a tenant with permissions to create Applications on the hub cluster to target and influence arbitrary managed (spoke) clusters. Exploitation of this vulnerability can force ArgoCD on the targeted spoke clusters to synchronize attacker-controlled manifests, which can result in arbitrary code execution or privilege escalation on those clusters.