A critical privilege escalation flaw (CVSS 9.1) in Red Hat's Multicluster Engine for Kubernetes lets a namespace-scoped tenant administrator mint a cluster-admin ServiceAccount token and take over the entire cluster.
What Is It
A flaw in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator holding only namespace-scoped privileges can create a namespaced ClusterCurator resource. Doing so inadvertently grants that tenant administrator the ability to mint a token for a ServiceAccount carrying cluster-wide administrative authority; resulting in full control over the cluster.
The issue is classified as CWE-266 (Incorrect Privilege Assignment) and was reported by Red Hat Product Security.
Why It Matters
The CVSS 3.1 base score is 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
The key detail is scope change (S:C): the attack starts inside one tenant namespace and ends at cluster-wide authority. Confidentiality, integrity, and availability impacts are all HIGH. Attack complexity is LOW and no user interaction is required. The mitigating factor is PR:H, the attacker must already hold administrative privileges within a namespace. In a multi-tenant cluster, that is exactly the trust boundary this flaw erases: every namespace tenant becomes a potential cluster admin.
What's Vulnerable
- Vendor: Red Hat
- Product: Multicluster Engine for Kubernetes
- Package:
multicluster-engine/cluster-curator-controller-rhel9 - CPE:
cpe:/a:redhat:multicluster_engine - Default status: affected
No specific fixed version ranges are listed in the supplied record.
Patch Status
The CVE was published 2026-08-05 and its NVD entry carries a status of Received: the record has not yet completed NVD analysis. No patch version, workaround, or fix advisory detail is present in the supplied data.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline or required action at this time.
Operators should track the Red Hat CVE page and the linked Bugzilla entry below for fix availability.
Sources
- Red Hat Security; CVE-2026-10059: https://access.redhat.com/security/cve/CVE-2026-10059
- NVD, CVE-2026-10059: https://nvd.nist.gov/vuln/detail/CVE-2026-10059
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Red Hat Bugzilla #2483187: https://bugzilla.redhat.com/show_bug.cgi?id=2483187
- Red Hat Package Browser: https://access.redhat.com/downloads/content/package-browser/