EUVD-2026-58132
GHSA-xp42-v53j-r9gh
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Network vector confirmed by API submission path; AC:H reflects need to enumerate foreign ManagedClusterSet names; PR:L requires valid tenant credential; S:C and C:H reflect cross-tenant cluster takeover with access to victim workloads.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.
AnalysisAI
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated tenant to force a managed cluster into another tenant's ManagedClusterSet by manipulating ClusterClaim labels. The clusterclaims-controller processes these label changes without enforcing tenant ownership boundaries, enabling the attacker to then inject policies and workloads into clusters they do not own. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated tenant account on a Red Hat Multicluster Engine hub (PR:L from CVSS vector) - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score is supported by a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, which appropriately reflects the scope change (S:C) as the vulnerability crosses tenant isolation boundaries to affect clusters owned by other parties. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated tenant on a shared MCE hub crafts a ClusterClaim resource with labels forged to reference a ManagedClusterSet owned by a separate tenant, then submits it via the standard Kubernetes API. The clusterclaims-controller, acting as a privileged intermediary, processes the label change and moves the targeted cluster into the foreign ManagedClusterSet without validating ownership boundaries. … |
| Remediation | The primary remediation is to apply the patch released by Red Hat for the clusterclaims-controller component; consult the official advisory at https://access.redhat.com/security/cve/CVE-2026-73266 for the specific fixed MCE version, as no exact patch version was confirmed in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of Red Hat MCE for Kubernetes and identify instances managing multiple tenant clusters; confirm current versions and document cluster-to-tenant mapping for risk assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privi
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user ga
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubern
Privilege escalation in Red Hat's managedcluster-import-controller (part of Multicluster Engine for Kubernetes) allows a
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A fla
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim p
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code e
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to esc
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials t
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShi
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today