Description
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
Published: 2026-08-12
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the cluster-curator-controller allows a user with namespace-local access to inject a specially named ClusterCurator resource. This resource triggers the creation of a cluster-scoped ClusterRoleBinding that grants the requester broad authority, including reading and writing secrets, managing cluster actions, and deleting hosted clusters or node pools. The vulnerability is a classic privilege-escalation flaw based on mis‑configured role binding creation, categorized as CWE-269.

Affected Systems

The vulnerability impacts Red Hat Multi-cluster Engine for Kubernetes. No specific version information is supplied, so all released editions may be susceptible until a fix is applied.

Risk and Exploitability

The CVSS score of 9.9 places this issue in the critical range, and although the EPSS score is not available, the lack of a KEV listing does not diminish the potential for exploitation. The likely attack vector is through the Kubernetes API by a local user who can create ClusterCurator resources. If successful, the attacker obtains cluster-wide privileges that could compromise secrets and overall cluster integrity.

Generated by OpenCVE AI on August 12, 2026 at 23:51 UTC.

Remediation

Vendor Workaround

To mitigate this issue, restrict the ability of tenants to create `ClusterCurator` resources. Implement Kubernetes Role-Based Access Control (RBAC) policies to limit `create` permissions for `clustercurators.cluster.open-cluster-management.io` resources to only trusted administrators or service accounts. Alternatively, deploy an admission controller to enforce that `metadata.name` and `metadata.namespace` fields are identical when `ClusterCurator` resources are created, preventing the vulnerable condition.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to the latest Red Hat Multi-cluster Engine release that resolves the cluster-curator-controller flaw.
  • Restrict tenant permissions to create ClusterCurator resources by configuring Kubernetes RBAC so only trusted administrators or service accounts have create access to "clustercurators.cluster.open-cluster-management.io".
  • Deploy an admission controller that enforces identical metadata.name and metadata.namespace values for ClusterCurator resources, thereby preventing the vulnerability’s trigger condition.

Generated by OpenCVE AI on August 12, 2026 at 23:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.10::el9
cpe:/a:redhat:multicluster_engine:2.6::el9
cpe:/a:redhat:multicluster_engine:2.8::el9
cpe:/a:redhat:multicluster_engine:2.9::el9
References

Tue, 25 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.17::el9
References

Tue, 25 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine cpe:/a:redhat:multicluster_engine:2.11::el9
References

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 12 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat multicluster Engine For Kubernetes
Vendors & Products Redhat multicluster Engine For Kubernetes

Wed, 12 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
Title Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa
First Time appeared Redhat
Redhat multicluster Engine
Weaknesses CWE-269
CPEs cpe:/a:redhat:multicluster_engine
Vendors & Products Redhat
Redhat multicluster Engine
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Redhat Multicluster Engine Multicluster Engine For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-26T04:19:48.429Z

Reserved: 2026-08-11T17:22:38.645Z

Link: CVE-2026-73269

cve-icon Vulnrichment

Updated: 2026-08-12T20:47:07.044Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T20:17:53.793

Modified: 2026-08-26T05:18:17.643

Link: CVE-2026-73269

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-11T00:00:00Z

Links: CVE-2026-73269 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T00:00:09Z

Weaknesses
  • CWE-269

    Improper Privilege Management