CVE-2026-73269
CVE-2026-73269: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityCritical9.9
Critical [CVE-2026-73269] tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SA
CVE-2026-73269Source published Source updated
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools. By creating a ClusterCurator resource with a mismatched name and namespace, an attacker can gain extensive permissions, including the ability to manage secrets and delete managed clusters, bypassing existing admission controls. This poses a significant risk to the overall cluster security and data…
- Affected products in this advisory
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.17
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
1 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- multicluster-engine/cluster-curator-controller-rhel9:1787201612
- multicluster-engine/cluster-curator-controller-rhel9:1787238383
- multicluster-engine/cluster-curator-controller-rhel9:1786750700
- multicluster-engine/cluster-curator-controller-rhel9:1787264185
8 more entries in the full advisory.
- Mitigation guidance
- To mitigate this issue, restrict the ability of tenants to create `ClusterCurator` resources. Implement Kubernetes Role-Based Access Control (RBAC) policies to limit `create` permissions for `clustercurators.cluster.open-cluster-management.io` resources to only trusted administrators or service accounts. Alternatively, deploy an admission controller to enforce that `metadata.name` and `metadata.namespace` fields are identical when `ClusterCurator` resources are created, preventing the vulnerable condition.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.