CVE-2026-73268
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.
Severity
CRITICAL
CVSS score
9.9
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-12 20:17:53.650000
Last modified
2026-10-24 15:10:00.190000
View original CVE JSON
{
"id": "CVE-2026-73268",
"sourceIdentifier": "[email protected]",
"published": "2026-08-12T20:17:53.650",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en el componente cluster-curator-controller del motor multiclúster (MCE). Un inquilino con permisos de creación o actualización en los recursos ClusterCurator puede inyectar una especificación de Job arbitraria. Esto es posible porque la función CreateJob() no valida la entrada controlada por el usuario al deserializar la extensión raw spec.install.overrideJob. La explotación exitosa permite que el Job inyectado se ejecute con los privilegios elevados del controlador, lo que lleva a la ejecución de código arbitrario y escalada de privilegios, potencialmente accediendo a secretos de todo el clúster."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.10",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"versions": [
{
"version": "1787201612",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"versions": [
{
"version": "1787238383",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.17::el9"
],
"versions": [
{
"version": "1786750700",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
],
"versions": [
{
"version": "1787264185",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"versions": [
{
"version": "1787259011",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-curator-controller-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"versions": [
{
"version": "1787201646",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-12T19:45:32.285133Z",
"id": "CVE-2026-73268",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:59556",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59557",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59558",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59559",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59579",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59593",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-73268",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514219",
"source": "[email protected]"
}
]
}