CVE-2026-73266
Received Received - Intake

Cluster Claim Manipulation in Multicluster Engine

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Red Hat, Inc.

Description
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73266
EUVD
EUVD-2026-58132

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat multicluster_engine *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the clusterclaims-controller of Multicluster Engine (MCE). An authenticated tenant can manipulate ClusterClaim labels to force a cluster into another tenant's ManagedClusterSet. This breaks tenant isolation and allows unauthorized policy or workload injection into other tenants' clusters.

Detection Guidance

Check for unauthorized ClusterClaim label manipulations in the clusterclaims-controller logs. Look for unexpected ManagedClusterSet joins or cross-tenant resource access patterns. Use commands like 'oc get clusterclaims -A' to inspect ClusterClaims and 'oc get managedclustersetbindings -A' to review bindings for anomalies.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain control over resources belonging to other tenants. This includes injecting unauthorized policies or workloads into clusters they do not own, potentially disrupting operations or stealing sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating compliance requirements for data protection and tenant isolation in GDPR and HIPAA. It undermines security controls designed to prevent cross-tenant data leakage.

Mitigation Strategies

Since mitigation is not available or does not meet criteria, restrict tenant permissions to prevent label manipulation. Monitor for unauthorized ManagedClusterSet joins and isolate affected clusters. Contact Red Hat support for updates as this is tracked under CWE-441.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73266. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart