Vulnerability in ManagedCluster Resource Deletion in Multicluster Engine by Red Hat
CVE-2026-73267
7.7HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 21 August 2026
What is CVE-2026-73267?
A flaw exists in the clusterclaims-controller of Red Hat's Multicluster Engine where a tenant with standard permissions can exploit the spec.namespace field. This manipulation allows unauthorized users to delete any ManagedCluster, including the hub's local-cluster or resources belonging to other tenants, due to a lack of ownership verification. Consequently, this can lead to significant service disruptions by enabling deletion of critical ManagedClusters.
Affected Version(s)
multicluster engine for Kubernetes 2.10 1787196014
multicluster engine for Kubernetes 2.11 1787239442
multicluster engine for Kubernetes 2.17 1786577950