CVE-2026-73269

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Cluster Curator Controller

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: redhat-SADP

Description

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73269

EUVD

EUVD-2026-57439

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	multicluster_engine	From 2026-08-11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a privilege escalation flaw in the cluster-curator-controller component of Red Hat's Multicluster Engine (MCE). A local user can create a ClusterCurator resource with mismatched metadata.name and metadata.namespace fields to trigger the creation of a cluster-scoped ClusterRoleBinding. This grants the user cluster-wide permissions, including access to secrets, management of cluster actions, and deletion of hosted clusters or node pools.

Detection Guidance

Check for ClusterCurator resources where metadata.name does not match metadata.namespace. Inspect RoleBindings and ClusterRoleBindings for unexpected cluster-scoped permissions. Review audit logs for unauthorized secret access or cluster modifications.

Impact Analysis

An attacker with namespace-local access can escalate privileges to gain full cluster-wide control. This allows them to access sensitive secrets, manipulate cluster configurations, delete critical resources like hosted clusters or node pools, and perform unauthorized actions across the entire cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as secrets, which may violate compliance requirements under GDPR or HIPAA. Unauthorized deletion or manipulation of cluster resources could also result in data breaches or loss of critical infrastructure, posing significant compliance risks.

Mitigation Strategies

Restrict ClusterCurator resource creation to trusted administrators using RBAC policies.
Deploy an admission controller to enforce matching metadata.name and metadata.namespace fields.
Audit existing ClusterCurator resources for mismatched namespaces and remove unauthorized bindings.

Hi! I’m here to help you understand CVE-2026-73269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70