CVE-2026-73268

Awaiting Analysis Awaiting Analysis - Queue

Cluster Curator Job Injection Vulnerability in Multicluster Engine

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: redhat-SADP

Description

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73268

EUVD

EUVD-2026-57442

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	multicluster_engine	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-73268 is a flaw in the cluster-curator-controller of multicluster engine (MCE). A user with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification because the CreateJob() function does not validate user-controlled input when processing the spec.install.overrideJob field. This allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation.

Detection Guidance

To detect this vulnerability, inspect ClusterCurator resources for suspicious Job specifications in the spec.install.overrideJob field. Check for unauthorized modifications to fields like image, command, serviceAccountName, hostNetwork, or volumes. Use commands like 'oc get clustercurators -A -o yaml' to review resources and 'oc describe clustercurator <name>' for detailed inspection.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code with elevated privileges on the cluster. They could access cluster-wide secrets, manipulate managed cluster permissions, and potentially take control of the entire cluster. The impact includes unauthorized data access, system compromise, and disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data processing, and failure to maintain confidentiality and integrity of protected health or personal information.

Mitigation Strategies

Immediately restrict create and update permissions on clustercurators.cluster.open-cluster-management.io resources to trusted administrators only. Review and audit all ClusterCurator resources for unauthorized Job specifications. Consider disabling the cluster-curator-controller component if not in use until patches are applied.

Hi! I’m here to help you understand CVE-2026-73268. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70