9.9

CVE-2026-73269

Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.10
Default Statusaffected
Version 1787201612
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.11
Default Statusaffected
Version 1787238383
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.17
Default Statusaffected
Version 1786750700
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.6
Default Statusaffected
Version 1787264185
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.8
Default Statusaffected
Version 1787259011
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.9
Default Statusaffected
Version 1787201646
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.144
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://access.redhat.com/security/cve/CVE-2026-73269
https://bugzilla.redhat.com/show_bug.cgi?id=2514220
https://access.redhat.com/errata/RHSA-2026:59556
https://access.redhat.com/errata/RHSA-2026:59593
https://access.redhat.com/errata/RHSA-2026:59557
https://access.redhat.com/errata/RHSA-2026:59559
https://access.redhat.com/errata/RHSA-2026:59579
https://access.redhat.com/errata/RHSA-2026:59558