CVE-2026-10059criticalCWE-266

CVE-2026-10059: fallo crítico en Red Hat multicluster engine for Kubernetes 2.1

Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear multicluster engine for Kubernetes

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.6%
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Red Hat · multicluster engine for Kubernetes 2.1Red Hat · multicluster engine for Kubernetes 2.11Red Hat · multicluster engine for Kubernetes 2.6Red Hat · multicluster engine for Kubernetes 2.8Red Hat · multicluster engine for Kubernetes 2.9
CVEs relacionadas — Red Hat multicluster engine for Kubernetes 2.1

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2026-73268CRITICALCluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injectionEPSS 0.9%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.6%CVE-2026-66794CRITICALCluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public routeEPSS 0.6%CVE-2026-75569HIGHMce-operator-bundle: all github actions pinned by mutable tag, not commit shaEPSS 0.6%CVE-2026-17107HIGHCluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterEPSS 0.6%