Critical Privilege Escalation in Red Hat Multicluster Engine Cluster Curator

Red Hat disclosed CVE-2026-73268, an Important-severity flaw in the cluster-curator-controller component of Multicluster Engine for Kubernetes that can let a tenant escalate privileges to the controller’s level. The issue stems from the CreateJob() function improperly unmarshaling user-controlled data from spec.install.overrideJob into a Kubernetes Job without validating dangerous fields, enabling arbitrary Job specification injection by users who can create or update ClusterCurator resources.

Successful exploitation can cause the injected Job to run under the controller’s privileged ServiceAccount, potentially allowing arbitrary code execution, access to cluster-wide secrets, and control over managed cluster resources. Red Hat scored the bug 9.9 CVSS v3.1 and linked it to CWE-94; affected software includes multicluster-engine/cluster-curator-controller-rhel9. Recommended mitigations include applying vendor fixes, tightening RBAC so only trusted administrators can manage clustercurators.cluster.open-cluster-management.io, and reviewing controller privileges and validation controls around Job creation.