Unauthorized Access Vulnerability in Multicluster Engine by Red Hat
CVE-2026-73266

7.1HIGH

Key Information:

Vendor

Red Hat
Status
Multicluster Engine For Kubernetes 2.10
Multicluster Engine For Kubernetes 2.11
Multicluster Engine For Kubernetes 2.17
Multicluster Engine For Kubernetes 2.6
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73266?

A flaw in the clusterclaims-controller of the Multicluster Engine allows authenticated tenants to manipulate ClusterClaim labels. This vulnerability can potentially let a tenant force a cluster to join a ManagedClusterSet belonging to another tenant. This unauthorized access opens the door for the injection of policies and workloads into clusters, which can disrupt operations and compromise security across environments.

Affected Version(s)

multicluster engine for Kubernetes 2.10 1787196014

multicluster engine for Kubernetes 2.11 1787239442

multicluster engine for Kubernetes 2.17 1786577950

References

https://access.redhat.com/errata/RHSA-2026:59556
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59557
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59558
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.