VDB

CVE-2026-73269

CVE-2026-73269 PUBLISHED CVSS 9.9 CRITICAL

Reported by redhat · Published August 12, 2026

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.

Risk Scores

CVSS 3.1
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.101787201612
Red Hatmulticluster engine for Kubernetes 2.111787238383
Red Hatmulticluster engine for Kubernetes 2.171786750700
Red Hatmulticluster engine for Kubernetes 2.61787264185
Red Hatmulticluster engine for Kubernetes 2.81787259011
Red Hatmulticluster engine for Kubernetes 2.91787201646
Red Hatmulticluster engine for Kubernetes 2.11787201612, 1787201612, 1787201612
Red Hatmulticluster engine for Kubernetes 2.61787264185, 1787264185, 1787264185
Red Hatmulticluster engine for Kubernetes 2.9.01787201646
Red Hatmulticluster engine for Kubernetes 2.91787201646, 1787201646, 1787201646
Red Hatmulticluster engine for Kubernetes 2.101787201612, 1787201612
Red HatMulticluster Engine for Kubernetes
Red Hatmulticluster engine for Kubernetes 2.171786750700, 1786750700, 1786750700
Red Hatmulticluster engine for Kubernetes 2.81787259011, 1787259011, 1787259011
Red Hatmulticluster engine for Kubernetes 2.111787238383, 1787238383, 1787238383

Timeline

  • Aug 12, 2026 Coalition ESS Score
  • Aug 12, 2026 CVE Published
  • Aug 14, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 4, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›