Loading vulnerability…
Cluster-wide Privilege Escalation in Multicluster Engine ClusterCurator
CVE-2026-10059 is an incorrect privilege-assignment flaw in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can create a namespaced ClusterCurator resource that causes the controller to create cluster-scoped RBAC permissions for a ServiceAccount in the tenant-controlled namespace. The tenant can then mint a token for that ServiceAccount, obtaining cluster-wide administrative authority and bypassing Kubernetes namespace-isolation boundaries.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants cluster-admin-level control of the Kubernetes cluster. An attacker can access resources across namespaces, including sensitive data and secrets; create or alter cluster-scoped RBAC and workloads; deploy privileged workloads; disrupt cluster operations; and potentially pivot to managed clusters.
If you can’t patch tonight, do this now.
No mitigation meeting the vendor's product security criteria was reported as currently available. Where immediate patching is not possible, reduce exposure by tightly restricting who can create or manage ClusterCurator resources, reviewing namespace-scoped tenant administrator permissions, auditing for unexpected ClusterCurator objects and privileged ServiceAccounts, and monitoring for unauthorized token minting or cluster-scoped RBAC creation associated with ClusterCurator activity. These measures are compensating controls only and do not fully remediate the flaw.
Patch, then assume compromise.
Update Multicluster Engine for Kubernetes to a release containing the vendor fix. Fixed releases identified for the affected release streams are MCE 2.5.2 and 2.4.5.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.