Vulnerability in Cluster Curator Component of Multicluster Engine by Red Hat
CVE-2026-73268
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 12 August 2026
What is CVE-2026-73268?
A flaw exists in the cluster-curator-controller component of the Multicluster Engine, where a tenant possessing create or update permissions on ClusterCurator resources can inject arbitrary Job specifications. This vulnerability arises from the CreateJob() function's failure to properly validate user-controlled input during the unmarshaling process of the spec.install.overrideJob raw extension. Successful exploitation of this flaw allows unauthorized Job execution with elevated privileges granted to the controller, posing a serious risk as it may lead to arbitrary code execution and potential access to sensitive cluster-wide secrets.
Affected Version(s)
multicluster engine for Kubernetes 2.10 1787201612
multicluster engine for Kubernetes 2.11 1787238383
multicluster engine for Kubernetes 2.17 1786750700