CVE-2026-10059
Received Received - Intake

Privilege Escalation in Multicluster Engine for Kubernetes

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Red Hat, Inc.

Description
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-10059
EUVD
EUVD-2026-53293

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat multicluster_engine_for_kubernetes to 2026-05-29 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can create a namespaced ClusterCurator. This action allows them to mint a token for a ServiceAccount with cluster-wide administrative authority, giving them full control over the cluster.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized ClusterCurator resources and ServiceAccounts with cluster-wide RBAC in tenant namespaces. Inspect ClusterCurator objects in all namespaces using kubectl get clustercurators -A. Look for ServiceAccounts named cluster-installer in tenant namespaces and verify their associated RBAC bindings with kubectl get clusterrolebindings. Check for tokens minted for these ServiceAccounts using kubectl get secrets -A and inspect their annotations for service account references.

Impact Analysis

An attacker with tenant administrator privileges could exploit this to gain full control over the Kubernetes cluster. This could lead to unauthorized access, data breaches, or disruption of services. The high CVSS score of 9.1 indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Kubernetes environments may face legal and regulatory penalties.

Mitigation Strategies

Immediate mitigation steps include revoking unauthorized cluster-wide RBAC bindings, deleting suspicious ClusterCurator resources, and removing any unauthorized ServiceAccounts or tokens. Restrict tenant administrator privileges to namespace-scoped access only. Monitor for new ClusterCurator creations and ServiceAccount token minting activities. Apply patches or updates once available from Red Hat.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart