CVE-2026-73269
CriticalCVSS 9.9Summary
A flaw in the cluster-curator-controller component allows a local user to create a ClusterCurator resource with a specific naming convention, triggering the creation of a cluster-scoped ClusterRoleBinding. This enables privilege escalation from namespace-local access to cluster-wide control.
Risk Assessment
A user with limited access could gain full cluster control, including access to secrets, managing cluster actions, and deleting hosted clusters or node pools, posing a severe security risk.
Recommendation
Restrict permissions to create or modify ClusterCurator resources, implement proper access controls, and monitor for such resource creation.
Original NVD description (English source)
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.