9.9
Critical
CVE-2026-73269 A flaw was found in the cluster-curator-controller component
Description
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Multicluster Engine for Kubernetes | Versions not published | |
| multicluster engine for Kubernetes 2.10 1787201612 | earliest → < 1787201612 | 1787201612 |
| multicluster engine for Kubernetes 2.11 1787238383 | earliest → < 1787238383 | 1787238383 |
| multicluster engine for Kubernetes 2.17 1786750700 | earliest → < 1786750700 | 1786750700 |
| multicluster engine for Kubernetes 2.6 1787264185 | earliest → < 1787264185 | 1787264185 |
| multicluster engine for Kubernetes 2.8 1787259011 | earliest → < 1787259011 | 1787259011 |
| multicluster engine for Kubernetes 2.9 1787201646 | earliest → < 1787201646 | 1787201646 |
| multicluster engine for Kubernetes 2.1 1787201612 | earliest → < 1787201612 | 1787201612 |
| multicluster engine for Kubernetes 2.9.0 1787201646 | earliest → < 1787201646 | 1787201646 |
Other CVEs of Multicluster Engine for Kubernetes
The 79 CVEs of Multicluster Engine for Kubernetes →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
3.3
Low
CVE-2026-71297
A flaw was found in the maestro gRPC broker
5.4
Medium
CVE-2026-71299
A flaw was found in Maestro
6.5
Medium