What is the CVSS score of EUVD-2026-53293?

EUVD-2026-53293 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Multicluster Engine are affected by EUVD-2026-53293?

Red Hat Multicluster Engine (MCE) for Kubernetes contains a critical privilege escalation vulnerability (CVE-2026-10059, CVSS 9.1) that enables namespace-scoped tenant administrators to break tenant…

How to fix or mitigate EUVD-2026-53293?

Within 24 hours: Inventory all Red Hat MCE deployments and audit current namespace-scoped administrative users and roles. Within 7 days: Implement strict RBAC controls restricting ClusterCurator resource creation to a minimal trusted set of operators, enable comprehensive audit logging for ClusterCurator API calls and ServiceAccount token generation, and review token lifetimes for all cluster-admin ServiceAccounts. Within 30 days: Establish a monitoring process for MCE security updates, prepare patching procedures for emergency deployment, and conduct forensic review of audit logs for unauthorized ClusterCurator creation or ServiceAccount token minting since deployment.

Multicluster Engine EUVD-2026-53293

| CVE-2026-10059 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-08-05 secalert@redhat.com

GHSA-f7c4-3r82-969w

Privilege Escalation Kubernetes

9.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Attacker is a limited namespace-scoped tenant (PR:L, not PR:H); creating one resource yields full cluster-admin, so scope changes (S:C) with total C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.1 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 09:30 vuln.today

CVE Published

Aug 05, 2026 - 09:18 nvd

CRITICAL 9.1

DescriptionCVE.org

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

Articles & Coverage 1

News Critical Privilege Escalation in Kubernetes MCE ClusterCurator - CVE-2026-10059 Aug 05, 2026

AnalysisAI

Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Multicluster Engine for Kubernetes is the Red Hat operator (the upstream engine behind Red Hat Advanced Cluster Management) that provisions and lifecycle-manages fleets of Kubernetes/OpenShift clusters. ClusterCurator is a custom resource and controller that orchestrates cluster provisioning, upgrade, and hook automation. The root cause maps to CWE-266 (Incorrect Privilege Assignment): the controller processes a tenant-supplied namespaced ClusterCurator in a way that lets the requester obtain a token for a highly privileged ServiceAccount, so an object a tenant is authorized to create is used as a vehicle to acquire credentials far exceeding the tenant's namespace scope. This is a classic controller confused-deputy / RBAC boundary failure where a namespaced control-plane resource influences cluster-scoped identity issuance.

Affected ProductsAI

Red Hat Multicluster Engine for Kubernetes (the ClusterCurator controller component), which also underpins Red Hat Advanced Cluster Management for Kubernetes. Specific fixed and affected version ranges are not enumerated in the provided NVD data; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10059 and the tracking bug https://bugzilla.redhat.com/show_bug.cgi?id=2483187 for the authoritative affected-version list and errata. No CPE strings were supplied in the input.

RemediationAI

No vendor-released patch version was identified in the provided data - monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-10059) and Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2483187) for the errata and apply the fixed MCE/ACM operator build as soon as it is published, since a corrected controller is the only complete fix. Until then, apply compensating controls: restrict who can create ClusterCurator custom resources by tightening RBAC so untrusted tenants cannot create or modify ClusterCurator objects in their namespaces (trade-off: tenants lose self-service curation/upgrade automation); avoid granting namespace-admin roles to untrusted tenants on clusters running MCE; and audit existing ServiceAccount token issuance and ClusterCurator creation events to detect abuse. If ClusterCurator-driven automation is not in use, consider disabling or scoping down the curator controller's ability to be invoked from tenant namespaces.