Loading vulnerability…
Privilege Escalation in Multicluster Engine cluster-curator-controller
CVE-2026-73268 is an improper input-validation flaw in the cluster-curator-controller component of Red Hat Multicluster Engine for Kubernetes. The controller's CreateJob() function unmarshals the user-controlled ClusterCurator spec.install.overrideJob raw extension without adequately validating the supplied Kubernetes Job specification. An authorized tenant can therefore inject an arbitrary Job that is subsequently created and executed using the controller's elevated privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution in the Kubernetes environment under the elevated permissions available to cluster-curator-controller. This permits privilege escalation and may expose cluster-wide secrets and managed-cluster access; the affected controller privileges can also allow high-impact modifications to cluster resources.
If you can’t patch tonight, do this now.
Enforce strict Kubernetes RBAC: limit create and update permissions for ClusterCurator resources to fully trusted administrators. Review existing ClusterCurator resources, especially spec.install.overrideJob values, for unauthorized or unexpected Job specifications, and review and minimize the controller service account's permissions where operationally feasible.
Patch, then assume compromise.
Apply the vendor security update for the affected Multicluster Engine cluster-curator-controller component. The supplied information does not identify a specific fixed version. Ensure the update enforces validation of user-controlled Job specifications supplied through spec.install.overrideJob.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.