VDB
CVE-2026-73268
CVE-2026-73268
PUBLISHED
CVSS 9.9 CRITICAL
Reported by redhat · Published August 12, 2026
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.
Risk Scores
CVSS 3.1
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.10 | 1787201612 |
| Red Hat | multicluster engine for Kubernetes 2.11 | 1787238383 |
| Red Hat | multicluster engine for Kubernetes 2.17 | 1786750700 |
| Red Hat | multicluster engine for Kubernetes 2.6 | 1787264185 |
| Red Hat | multicluster engine for Kubernetes 2.8 | 1787259011 |
| Red Hat | multicluster engine for Kubernetes 2.9 | 1787201646 |
| Red Hat | multicluster engine for Kubernetes 2.9.0 | 1787201646 |
| Red Hat | multicluster engine for Kubernetes 2.9 | 1787201646, 1787201646, 1787201646 |
| Red Hat | multicluster engine for Kubernetes 2.1 | 1787201612, 1787201612, 1787201612 |
| Red Hat | Multicluster Engine for Kubernetes | |
| Red Hat | multicluster engine for Kubernetes 2.17 | 1786750700, 1786750700, 1786750700 |
| Red Hat | multicluster engine for Kubernetes 2.11 | 1787238383, 1787238383, 1787238383 |
| Red Hat | multicluster engine for Kubernetes 2.10 | 1787201612, 1787201612 |
| Red Hat | multicluster engine for Kubernetes 2.6 | 1787264185, 1787264185, 1787264185 |
| Red Hat | multicluster engine for Kubernetes 2.8 | 1787259011, 1787259011, 1787259011 |
Timeline
- Aug 12, 2026 Coalition ESS Score
- Aug 12, 2026 CVE Published
- Aug 14, 2026 CVE Updated
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
References
- RHSA-2026:59556 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:59557 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:59558 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:59559 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:59579 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:59593 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2514219 issue-trackingx_refsource_REDHAT