EUVD-2026-57442
GHSA-6c6p-j4gf-mj2c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable API with a low-privileged tenant grant (PR:L), no user interaction, and a scope change (S:C) from tenant to cluster service-account authority yielding full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.
AnalysisAI
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated principal (PR:L) with create or update permission on ClusterCurator custom resources in an MCE-managed cluster, and the attacker must populate the spec.install.overrideJob raw extension with a crafted Job specification that CreateJob() then deserializes without validation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A namespace tenant who has been delegated create/update rights on ClusterCurator resources submits a ClusterCurator whose spec.install.overrideJob defines a malicious Job - for example a pod that reads cluster secrets or launches a reverse shell. The cluster-curator-controller unmarshals and runs that Job under its own elevated service account, and the attacker escalates from limited tenant to cluster-wide access. … |
| Remediation | No vendor-released patch version is identified in the available data; the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-73268) and Bugzilla 2514219 (https://bugzilla.redhat.com/show_bug.cgi?id=2514219) should be monitored for the fixed MCE/RHACM errata and applied as the primary fix once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all user and service account permissions on ClusterCurator resources across all MCE deployments and disable create/update access for all non-essential accounts; enable audit logging for ClusterCurator resource modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user ga
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubern
Privilege escalation in Red Hat's managedcluster-import-controller (part of Multicluster Engine for Kubernetes) allows a
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A fla
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim p
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code e
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated t
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to esc
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials t
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShi
Same weakness CWE-94 – Code Injection
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today