privilege-escalation-methodcloud-service-vulnerabilitywidely-deployed-product-advisory

Critical Privilege Escalation in OpenShift Multicluster Engine cluster-curator-controller

Attack Tradecraft · 3 sources · Updated 3mo ago · First seen Aug 12, 2026

Red Hat disclosed CVE-2026-73269, a critical privilege-escalation flaw in the cluster-curator-controller component used by OpenShift Multicluster Engine for Kubernetes. The bug allows a tenant with only namespace-level access to create a crafted ClusterCurator resource whose metadata.name differs from metadata.namespace, triggering the controller to create a cluster-scoped ClusterRoleBinding and, in some cases, a RoleBinding in an arbitrary namespace. Those bindings can attach the tenant’s namespace-local cluster-installer service account to the powerful curator role, effectively breaking namespace isolation.

Successful exploitation can elevate a local tenant to cluster-wide privileges, including access to and manipulation of secrets, management of cluster actions, and deletion of hosted clusters or node pools. The issue carries a CVSS 3.1 score of 9.9 and affects multicluster-engine/cluster-curator-controller-rhel9. Red Hat advised organizations to apply vendor fixes and reduce exposure by restricting creation of ClusterCurator resources through RBAC, enforcing matching metadata.name and metadata.namespace with an admission controller, and reviewing permissions that allow creation of cluster-scoped resources.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Aug 11, 2026 – Aug 12, 2026

Aug 12, 20263mo ago
Red Hat updates the CVE-2026-73269 record
Red Hat last modified the CVE-2026-73269 record, maintaining the affected product details, severity information, and mitigation guidance. The entry still indicated no erratum was listed for the affected package.
CVE-2026-73269 - Red Hat Customer Portal
Aug 11, 20263mo ago
Bugzilla records cluster-curator-controller privilege-escalation flaw
Red Hat Bugzilla recorded issue 2514220 describing how a ClusterCurator resource with mismatched metadata.name and metadata.namespace can cause ApplyRBACHypershift to create a RoleBinding in an arbitrary namespace and a cluster-scoped ClusterRoleBinding. The report states this can bind a namespace-local service account to the curator ClusterRole and escalate access to cluster-wide privileges.
2514220 - (CVE-2026-73269) CVE-2026-73269 cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SA
Aug 11, 20263mo ago
Red Hat publishes CVE-2026-73269
Red Hat published CVE-2026-73269 for a privilege-escalation flaw in the Multicluster Engine cluster-curator-controller. The issue allows a tenant with namespace-level access to craft a ClusterCurator resource that triggers creation of bindings granting cluster-wide privileges.
CVE-2026-73269 - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Cluster-wide privilege escalation in Multicluster Engine cluster-curator-controller (CVE-2026-73269)

Affected products

1 linked

Multicluster Engine For Kubernetes

Organizations

1 linked

Red Hat

Observables

1 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Aug 12, 2026

CVE-2026-73269 - Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local saOpen source ↗

Redhat AccessNews · Aug 12, 2026

CVE-2026-73269 - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · Aug 11, 2026

2514220 - (CVE-2026-73269) CVE-2026-73269 cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SAOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

privilege-escalation-methodcloud-service-vulnerabilitywidely-deployed-product-advisory

Critical Privilege Escalation in OpenShift Multicluster Engine cluster-curator-controller

Attack Tradecraft · 3 sources · Updated 3mo ago · First seen Aug 12, 2026

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Aug 11, 2026 – Aug 12, 2026

Aug 12, 20263mo ago
Red Hat updates the CVE-2026-73269 record
Red Hat last modified the CVE-2026-73269 record, maintaining the affected product details, severity information, and mitigation guidance. The entry still indicated no erratum was listed for the affected package.
CVE-2026-73269 - Red Hat Customer Portal
Aug 11, 20263mo ago
Bugzilla records cluster-curator-controller privilege-escalation flaw
Red Hat Bugzilla recorded issue 2514220 describing how a ClusterCurator resource with mismatched metadata.name and metadata.namespace can cause ApplyRBACHypershift to create a RoleBinding in an arbitrary namespace and a cluster-scoped ClusterRoleBinding. The report states this can bind a namespace-local service account to the curator ClusterRole and escalate access to cluster-wide privileges.
2514220 - (CVE-2026-73269) CVE-2026-73269 cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SA
Aug 11, 20263mo ago
Red Hat publishes CVE-2026-73269
Red Hat published CVE-2026-73269 for a privilege-escalation flaw in the Multicluster Engine cluster-curator-controller. The issue allows a tenant with namespace-level access to craft a ClusterCurator resource that triggers creation of bindings granting cluster-wide privileges.
CVE-2026-73269 - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →