CVE-2026-10059
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.
Risk Assessment
A tenant administrator can gain full control over the cluster, potentially leading to security breaches of the entire environment and data.
Recommendation
Upgrade Multicluster Engine to a patched version and implement mechanisms to restrict the ability to create ClusterCurator for users with limited privileges.
Other vulnerabilities in Multicluster Engine for Kubernetes
See all- CVE-2026-66794Critical
In the cluster-proxy-addon component of Multicluster Engine for Kubernetes, an unauthenticated attacker with access to the user-facing route can bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster.
- CVE-2025-57851Medium
In Multicluster Engine for Kubernetes images, the /etc/passwd file is created with group-writable permissions. An attacker with container access, even as non-root, who is a member of the root group can modify this file and add a user with any UID, including 0, gaining full root privileges in the container.
Original NVD description (English source)
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.