CVE-2026-73269
Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
| CWE | CWE-269 |
| Vendor | red hat |
| Product | multicluster engine for kubernetes |
| Published | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat multicluster engine for kubernetes
Be the first to know when new critical vulnerabilities affecting red hat multicluster engine for kubernetes are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Red Hat / Multicluster Engine for Kubernetes
All versions affected