9.9

CVE-2026-73268

Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.10
Default Statusaffected
Version 1787201612
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.11
Default Statusaffected
Version 1787238383
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.17
Default Statusaffected
Version 1786750700
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.6
Default Statusaffected
Version 1787264185
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.8
Default Statusaffected
Version 1787259011
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.9
Default Statusaffected
Version 1787201646
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.3
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://access.redhat.com/security/cve/CVE-2026-73268
https://bugzilla.redhat.com/show_bug.cgi?id=2514219
https://access.redhat.com/errata/RHSA-2026:59556
https://access.redhat.com/errata/RHSA-2026:59593
https://access.redhat.com/errata/RHSA-2026:59557
https://access.redhat.com/errata/RHSA-2026:59559
https://access.redhat.com/errata/RHSA-2026:59579
https://access.redhat.com/errata/RHSA-2026:59558