Loading vulnerability…
Cluster-wide privilege escalation in Multicluster Engine cluster-curator-controller
CVE-2026-73269 is an improper privilege-management vulnerability in the cluster-curator-controller component of Red Hat Multicluster Engine for Kubernetes. A namespace-local user able to create ClusterCurator custom resources can submit a resource whose name and namespace use the vulnerable mismatched naming condition. The controller can then create a cluster-scoped ClusterRoleBinding for a namespace-local service account, bypassing intended namespace isolation and elevating that principal to cluster-wide permissions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation escalates a namespace-local principal to cluster-wide control. The resulting permissions can permit reading and modifying Kubernetes secrets, managing cluster actions, and deleting HostedCluster or NodePool resources. The vulnerability has a CVSS v3.1 score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), with high confidentiality, integrity, and availability impact.
If you can’t patch tonight, do this now.
Restrict creation of ClusterCurator resources to trusted administrators and service accounts using Kubernetes RBAC. Deploy an admission control policy that requires metadata.name and metadata.namespace to be identical for ClusterCurator resources. Review cluster-curator permissions and monitor for unexpected creation or modification of cluster-scoped ClusterRoleBinding objects.
Patch, then assume compromise.
Apply the vendor-provided security update for the affected cluster-curator-controller component. The available information confirms that a security patch was committed, but does not identify a fixed package or product version; consult the applicable Red Hat errata and release documentation to select the updated build for the deployed Multicluster Engine release.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.