Critical [CVE-2026-73269] tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SA
This critical-severity Red Hat Linux advisory covers CVE-2026-73269 affecting multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17, multicluster engine for Kubernetes 2.6.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding.
This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
By creating a ClusterCurator resource with a mismatched name and namespace, an attacker can gain extensive permissions, including the ability to manage secrets and delete managed clusters, bypassing existing admission controls.
This poses a significant risk to the overall cluster security and data integrity within Red Hat OpenShift environments deploying MCE. Red Hat severity: Important — CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Weakness: CWE-269. Affected Red Hat products: multicluster engine for Kubernetes 2.1; multicluster engine for Kubernetes 2.11; multicluster engine for Kubernetes 2.17; multicluster engine for Kubernetes 2.6; multicluster engine for Kubernetes 2.8; multicluster engine for Kubernetes 2.9.
Red Hat fixing advisory: RHSA-2026:59557, RHSA-2026:59556, RHSA-2026:59593, RHSA-2026:59579, RHSA-2026:59558, RHSA-2026:59559.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
- multicluster-engine/cluster-curator-controller-rhel9:1787201612
- multicluster-engine/cluster-curator-controller-rhel9:1787238383
- multicluster-engine/cluster-curator-controller-rhel9:1786750700
- multicluster-engine/cluster-curator-controller-rhel9:1787264185
- multicluster-engine/cluster-curator-controller-rhel9:1787259011
- multicluster-engine/cluster-curator-controller-rhel9:1787201646
- RHSA-2026:59557
- RHSA-2026:59556
- RHSA-2026:59593
- RHSA-2026:59579
- RHSA-2026:59558
- RHSA-2026:59559
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Mitigation checklist
- To mitigate this issue, restrict the ability of tenants to create `ClusterCurator` resources. Implement Kubernetes Role-Based Access Control (RBAC) policies to limit `create` permissions for `clustercurators.cluster.open-cluster-management.io` resources to only trusted administrators or service accounts. Alternatively, deploy an admission controller to enforce that `metadata.name` and `metadata.namespace` fields are identical when `ClusterCurator` resources are created, preventing the vulnerable condition.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.