VDB

CVE-2026-73266

CVE-2026-73266 PUBLISHED CVSS 7.1 HIGH

Reported by redhat · Published August 13, 2026

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

Risk Scores

CVSS 3.1
7.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.101787196014
Red Hatmulticluster engine for Kubernetes 2.111787239442
Red Hatmulticluster engine for Kubernetes 2.171786577950
Red Hatmulticluster engine for Kubernetes 2.61787259112
Red Hatmulticluster engine for Kubernetes 2.81787259059
Red Hatmulticluster engine for Kubernetes 2.91787195995
Red Hatmulticluster engine for Kubernetes 2.171786577950
Red Hatmulticluster engine for Kubernetes 2.9.01787195995
Red Hatmulticluster engine for Kubernetes 2.61787259112
Red Hatmulticluster engine for Kubernetes 2.91787195995
Red HatMulticluster Engine for Kubernetes
Red Hatmulticluster engine for Kubernetes 2.81787259059
Red Hatmulticluster engine for Kubernetes 2.11787196014
Red Hatmulticluster engine for Kubernetes 2.101787196014
Red Hatmulticluster engine for Kubernetes 2.111787239442

Timeline

  • Aug 13, 2026 CVE Published
  • Aug 14, 2026 Coalition ESS Score
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 17, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 26, 2026 EPSS Score
  • Sep 29, 2026 CVE Updated
  • Sep 30, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›