VDB

CVE-2026-73267

CVE-2026-73267 PUBLISHED CVSS 7.7 HIGH

Reported by redhat · Published August 21, 2026

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.

Risk Scores

CVSS 3.1
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.101787196014
Red Hatmulticluster engine for Kubernetes 2.111787239442
Red Hatmulticluster engine for Kubernetes 2.171786577950
Red Hatmulticluster engine for Kubernetes 2.61787259112
Red Hatmulticluster engine for Kubernetes 2.81787259059
Red Hatmulticluster engine for Kubernetes 2.91787195995
Red Hatmulticluster engine for Kubernetes 2.61787259112
Red Hatmulticluster engine for Kubernetes 2.101787196014, 1787196014, 1787196014
Red Hatmulticluster engine for Kubernetes 2.171786577950, 1786577950, 1786577950
Red Hatmulticluster engine for Kubernetes 2.91787195995, 1787195995, 1787195995
Red Hatmulticluster engine for Kubernetes 2.11787196014
Red Hatmulticluster engine for Kubernetes 2.9.01787195995
Red Hatmulticluster engine for Kubernetes 2.111787239442, 1787239442, 1787239442
Red Hatmulticluster engine for Kubernetes 2.81787259059, 1787259059, 1787259059
Red HatMulticluster Engine for Kubernetes

Timeline

  • Aug 21, 2026 CVE Published
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 26, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›