9.1
Critical
CVE-2026-10059 A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller
Description
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Multicluster Engine for Kubernetes | Versions not published | |
| multicluster engine for Kubernetes 2.10 1787201612 | earliest → < 1787201612 | 1787201612 |
| multicluster engine for Kubernetes 2.11 1787238383 | earliest → < 1787238383 | 1787238383 |
| multicluster engine for Kubernetes 2.6 1787264185 | earliest → < 1787264185 | 1787264185 |
| multicluster engine for Kubernetes 2.8 1787259011 | earliest → < 1787259011 | 1787259011 |
| multicluster engine for Kubernetes 2.9 1787201646 | earliest → < 1787201646 | 1787201646 |
| multicluster engine for Kubernetes 2.1 1787201612 | earliest → < 1787201612 | 1787201612 |
| multicluster engine for Kubernetes 2.9.0 1787201646 | earliest → < 1787201646 | 1787201646 |
Other CVEs of Multicluster Engine for Kubernetes
The 79 CVEs of Multicluster Engine for Kubernetes →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
3.3
Low
CVE-2026-71297
A flaw was found in the maestro gRPC broker
5.4
Medium
CVE-2026-71299
A flaw was found in Maestro
6.5
Medium