A flaw in the clusterclaims-controller component of Multicluster Engine for Kubernetes allows a tenant with standard create and delete permissions on ClusterClaim resources to manipulate the spec.namespace field. By specifying the namespace of any ManagedCluster, the tenant can trigger deletion of that cluster, including the hub’s local-cluster or other tenants’ clusters. The missing ownership check means the action is performed without verifying that the tenant owns the target, leading to a denial of service through the loss of cluster resources. The weakness is classified as CWE-602, an improper restriction of resource access.

The vulnerability affects Red Hat Multicluster Engine for Kubernetes, specifically the clusterclaims-controller component. No specific version information was provided in the CNA data, so all deployments of this component are potentially impacted.

The CVSS score of 7.7 indicates a high severity. EPSS data is unavailable, and the flaw is not listed in CISA KEV, suggesting that while the vulnerability is serious, current exploitation rates are unknown. The attack vector is likely intra‑cluster: a tenant exercising normal API permissions can craft a malicious ClusterClaim. No external network attack is required, but any tenant with access to the control plane can exploit the flaw, making it a high‑risk denial of service scenario for the entire managed cluster environment.