CVE-2026-73267
Received Received - Intake

ClusterClaim Privilege Escalation in Multicluster Engine

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: redhat-SADP

Description
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-73267
EUVD
EUVD-2026-63800

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat multicluster_engine From 0.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the clusterclaims-controller of multicluster engine (MCE). A tenant with standard permissions can manipulate the spec.namespace field in ClusterClaim resources to delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters. This happens because the controller lacks ownership checks when deleting resources.

Detection Guidance

To detect this vulnerability, monitor for unauthorized deletion of ManagedCluster resources or suspicious activity in the clusterclaims-controller logs. Check for ClusterClaim resources with manipulated spec.namespace fields targeting unintended clusters. Review audit logs for deletions of critical clusters like local-cluster.

Impact Analysis

It allows unauthorized deletion of ManagedClusters, leading to denial of service. Attackers could target critical clusters like the hub's local-cluster, disrupting operations and causing system-wide outages.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized deletion of ManagedClusters, which may include critical data processing or healthcare systems. Unauthorized access or disruption of clusters could lead to violations of data integrity, availability, or confidentiality requirements under these regulations.

Mitigation Strategies

Immediately restrict permissions for ClusterClaim resource creation/deletion to trusted users only. Temporarily disable the clusterclaims-controller if possible. Monitor for active exploitation and apply patches once available. Review and audit all ClusterClaim resources for unauthorized spec.namespace values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart