CVE-2026-10059
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.
Severity
CRITICAL
CVSS score
9.1
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-05 09:18:13.720000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-10059",
"sourceIdentifier": "[email protected]",
"published": "2026-08-05T09:18:13.720",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster."
},
{
"lang": "es",
"value": "Se encontró una falla en el controlador ClusterCurator de Multicluster Engine para Kubernetes. Un administrador de inquilinos con privilegios de ámbito de espacio de nombres puede explotar esta vulnerabilidad al crear un ClusterCurator con ámbito de espacio de nombres. Esta acción otorga inadvertidamente al administrador de inquilinos la capacidad de acuñar un token para una ServiceAccount con autoridad administrativa de ámbito de clúster. Esto conduce a una escalada de privilegios, lo que permite al administrador de inquilinos obtener control total sobre el clúster."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.1",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"versions": [
{
"version": "1787201612",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"versions": [
{
"version": "1787238383",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
],
"versions": [
{
"version": "1787264185",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"versions": [
{
"version": "1787259011",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"versions": [
{
"version": "1787201646",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-05T14:21:58.044319Z",
"id": "CVE-2026-10059",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-266"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:59556",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59557",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59558",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59559",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59579",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-10059",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483187",
"source": "[email protected]"
}
]
}