CVE-2026-73268

CriticalCVSS 9.9/10Last modified Oct 24, 2026

Description

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	multicluster engine for Kubernetes 2.10	—
Red Hat	multicluster engine for Kubernetes 2.11	—
Red Hat	multicluster engine for Kubernetes 2.17	—
Red Hat	multicluster engine for Kubernetes 2.6	—
Red Hat	multicluster engine for Kubernetes 2.8	—
Red Hat	multicluster engine for Kubernetes 2.9	—

References

Timeline

Published: Aug 12, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-732699.9A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming con CVE-2026-73278.1An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 1 CVE-2026-732708.2Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside CVE-2026-732734.3Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated CVE-2026-732768.3Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP CVE-2026-732789.8Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second fa CVE-2026-73286.8Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsy CVE-2026-732813.5In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that a CVE-2026-732824.8In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.CVE-2026-732832.5In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.CVE-2026-732848.8RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accept CVE-2026-732857.5RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled