CVE-2026-73269criticalCWE-269

CVE-2026-73269: critical vulnerability in Red Hat multicluster engine for Kubernetes 2.10

Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa

Published · Updated

Follow this CVE+ Monitor multicluster engine for Kubernetes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 0.6%
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Red Hat · multicluster engine for Kubernetes 2.10Red Hat · multicluster engine for Kubernetes 2.11Red Hat · multicluster engine for Kubernetes 2.17Red Hat · multicluster engine for Kubernetes 2.6Red Hat · multicluster engine for Kubernetes 2.8Red Hat · multicluster engine for Kubernetes 2.9
Related CVEs — Red Hat multicluster engine for Kubernetes 2.10

In the same product, most dangerous first.

CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2026-73268CRITICALCluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injectionEPSS 0.9%CVE-2026-10059CRITICALCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenEPSS 0.6%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.6%CVE-2026-66794CRITICALCluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public routeEPSS 0.6%CVE-2026-75569HIGHMce-operator-bundle: all github actions pinned by mutable tag, not commit shaEPSS 0.6%