CVE-2026-73266
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels, forcing a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.
Risk Assessment
Risk of unauthorized access to other tenants' clusters, potentially leading to isolation breaches and injection of malicious policies or workloads.
Recommendation
Apply vendor-provided patches for MCE and restrict permissions to manipulate ClusterClaim labels.
Other vulnerabilities in Multicluster Engine
See all- CVE-2026-19130Medium
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster and knowledge of a prior credential value could exploit an authorization bypass. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure.
- CVE-2026-7163Medium
A vulnerability in the assisted-service REST API, an optional Assisted Installer component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, which unconditionally grants full administrative access to any request bearing a valid JWT. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace.
Original NVD description (English source)
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS