VDB

CVE-2026-10059

CVE-2026-10059 PUBLISHED CVSS 9.1 CRITICAL

Reported by redhat · Published August 5, 2026

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

Risk Scores

CVSS 3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.11787201612
Red Hatmulticluster engine for Kubernetes 2.111787238383
Red Hatmulticluster engine for Kubernetes 2.61787264185
Red Hatmulticluster engine for Kubernetes 2.81787259011
Red Hatmulticluster engine for Kubernetes 2.91787201646
Red Hatmulticluster engine for Kubernetes 2.111787238383
Red Hatmulticluster engine for Kubernetes 2.91787201646
Red Hatmulticluster engine for Kubernetes 2.11787201612
Red Hatmulticluster engine for Kubernetes 2.81787259011
Red Hatmulticluster engine for Kubernetes 2.61787264185

Timeline

  • Aug 5, 2026 EPSS Score
  • Aug 5, 2026 Coalition ESS Score
  • Aug 5, 2026 CVE Published
  • Aug 5, 2026 PoC Published
  • Aug 5, 2026 PoC Published
  • Aug 5, 2026 PoC Published
  • Aug 6, 2026 Security Advisory
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 4, 2026 EPSS Score
  • Sep 8, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›