EUVD-2026-53293
GHSA-f7c4-3r82-969w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attacker is a limited namespace-scoped tenant (PR:L, not PR:H); creating one resource yields full cluster-admin, so scope changes (S:C) with total C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold namespace-scoped tenant-administrator privileges on a cluster running Multicluster Engine, and requires that they be able to create a ClusterCurator custom resource in a namespace they control - creating that namespaced ClusterCurator is the specific triggering action that causes the controller to mint a cluster-admin ServiceAccount token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1 Critical) indicates network-reachable, low-complexity exploitation with a changed scope and full CIA impact, but it requires existing privileges (PR:H) - the attacker must already be a tenant/namespace administrator, so this is an insider or post-compromise escalation rather than an anonymous internet attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified in the provided data - monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-10059) and Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2483187) for the errata and apply the fixed MCE/ACM operator build as soon as it is published, since a corrected controller is the only complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Red Hat MCE deployments and audit current namespace-scoped administrative users and roles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today