Privilege Escalation in Red Hat ClusterCurator Grants Full Kubernetes Cluster Control

Red Hat disclosed CVE-2026-10059, an Important-severity privilege-escalation flaw in the ClusterCurator controller component of Multicluster Engine for Kubernetes. The vulnerability allows a tenant administrator with only namespace-scoped privileges to create a namespaced ClusterCurator, which causes the controller to create a cluster-installer ServiceAccount in the tenant namespace and bind it to cluster-wide curator privileges. Red Hat scored the issue CVSS 9.1 and mapped it to CWE-266 for incorrect privilege assignment.

Because the privileged ServiceAccount is created inside a tenant-controlled namespace, an attacker with namespace admin rights can mint a token for it and immediately inherit cluster-wide authority, effectively gaining full control of the Kubernetes cluster. Red Hat said the affected component is multicluster-engine/cluster-curator-controller-rhel9, reported that no mitigation meeting its product security criteria is currently available, and credited Christopher Lusk of North Echo Security Research with reporting the bug.