9.1
Critique
CVE-2026-10059 A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller
Description
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Multicluster Engine for Kubernetes | Versions non publiées | |
| multicluster engine for Kubernetes 2.10 1787201612 | premières → < 1787201612 | 1787201612 |
| multicluster engine for Kubernetes 2.11 1787238383 | premières → < 1787238383 | 1787238383 |
| multicluster engine for Kubernetes 2.6 1787264185 | premières → < 1787264185 | 1787264185 |
| multicluster engine for Kubernetes 2.8 1787259011 | premières → < 1787259011 | 1787259011 |
| multicluster engine for Kubernetes 2.9 1787201646 | premières → < 1787201646 | 1787201646 |
| multicluster engine for Kubernetes 2.1 1787201612 | premières → < 1787201612 | 1787201612 |
| multicluster engine for Kubernetes 2.9.0 1787201646 | premières → < 1787201646 | 1787201646 |
Autres CVE de Multicluster Engine for Kubernetes
Les 79 CVE de Multicluster Engine for Kubernetes →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
3.3
Faible
CVE-2026-71297
A flaw was found in the maestro gRPC broker
5.4
Moyenne
CVE-2026-71299
A flaw was found in Maestro
6.5
Moyenne