EUVD-2026-57439
GHSA-h2w9-5qx3-frqq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated namespace user (PR:L) acts over the Kubernetes API (AV:N/AC:L), and the escalation crosses the tenancy boundary (S:C) yielding full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
AnalysisAI
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user gain cluster-wide control by abusing the cluster-curator-controller. By creating a ClusterCurator custom resource with a specific, attacker-chosen naming convention, the user tricks the controller into minting a cluster-scoped ClusterRoleBinding on their behalf, breaking the namespace isolation boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated principal (PR:L) that already possesses rights to create a ClusterCurator custom resource within a namespace on an MCE hub cluster running the cluster-curator-controller. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 Critical) is internally consistent with the description: a low-privileged authenticated user (PR:L) acting over the Kubernetes API (AV:N) with low complexity and no user interaction triggers a scope change (S:C) yielding full confidentiality, integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer or CI service account holding only namespace-scoped access to an MCE hub cluster creates a ClusterCurator resource named according to the specific convention the controller trusts. The cluster-curator-controller reconciles it and creates a cluster-scoped ClusterRoleBinding granting the attacker cluster-wide rights, after which they read platform secrets and delete hosted clusters or node pools. … |
| Remediation | Apply the Red Hat-provided update for multicluster engine for Kubernetes once released; the input data does not contain an exact fixed version, so obtain the precise patched build from the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-73269 and the Bugzilla tracker https://bugzilla.redhat.com/show_bug.cgi?id=2514220 (no exact fix version provided in the input - verify with the vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Red Hat MCE deployments and audit authenticated users with namespace-scoped access; immediately implement RBAC policies preventing non-administrators from creating or modifying ClusterCurator custom resources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privi
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubern
Privilege escalation in Red Hat's managedcluster-import-controller (part of Multicluster Engine for Kubernetes) allows a
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A fla
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim p
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code e
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated t
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to esc
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials t
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShi
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today