CVE-2026-73269

CriticalCVSS 9.9

Published: 12/08/2026(UTC)Updated: 08/09/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

A flaw in the cluster-curator-controller component allows a local user to create a ClusterCurator resource with a specific naming convention, triggering the creation of a cluster-scoped ClusterRoleBinding. This enables privilege escalation from namespace-local access to cluster-wide control.

Risk Assessment

A user with limited access could gain full cluster control, including access to secrets, managing cluster actions, and deleting hosted clusters or node pools, posing a severe security risk.

Recommendation

Restrict permissions to create or modify ClusterCurator resources, implement proper access controls, and monitor for such resource creation.

Other vulnerabilities in cluster-curator-controller

CVE-2026-73268Critical
A flaw in the cluster-curator-controller component of multicluster engine (MCE) allows a tenant with create or update permissions on ClusterCurator resources to inject an arbitrary Job specification. The CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension.

Original NVD description (English source)

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS