A flaw in the cluster-curator-controller component of Red Hat Multicluster Engine for Kubernetes allows a tenant with create or update permissions on ClusterCurator resources to inject an arbitrary Job specification. The CreateJob() function fails to validate user-controlled input contained in the spec.install.overrideJob raw extension, permitting the injected Job to run with the controller’s elevated privileges. Successful exploitation results in arbitrary code execution and privilege escalation, potentially exposing cluster‑wide secrets and compromising the entire Kubernetes environment.

Red Hat Multicluster Engine for Kubernetes – specifically the cluster-curator-controller component that processes ClusterCurator resources. The vulnerability is tied to any instance where tenants can create or update ClusterCurator objects; specific version information is not provided in the CVE data.

The CVSS score of 9.9 indicates extreme severity, and while the EPSS score is not available, the lack of a KEV listing does not reduce the risk. Attackers who can obtain or abuse create or update rights on clustercurators.cluster.open-cluster-management.io can inject malicious job definitions, leading to full control over the cluster. The exploitation path requires only RBAC privileges; therefore, misconfigured or overly permissive RBAC poses a high likelihood for successful attacks.