A CVSS 9.9 code-injection flaw in the multicluster engine (MCE) cluster-curator-controller allows any tenant with write access to ClusterCurator resources to inject an arbitrary Kubernetes Job that runs with the controller's elevated privileges.
What Is It
The flaw sits in the CreateJob() function of MCE's cluster-curator-controller component. When unmarshaling the spec.install.overrideJob raw extension, the function does not validate user-controlled input. A tenant holding create or update permissions on ClusterCurator resources can therefore supply an arbitrary Job specification of their choosing.
Red Hat classifies the issue as CWE-94 (improper control of code generation / code injection). The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network-reachable, low complexity, no user interaction, and requiring only low privileges, with a changed scope reflecting the jump from tenant context to controller context.
Why It Matters
The injected Job executes with the controller's elevated privileges rather than the tenant's. That yields arbitrary code execution and privilege escalation, and can expose cluster-wide secrets. In a multi-tenant cluster, the security boundary between a namespace-scoped tenant and the cluster itself collapses: a low-privileged account becomes an avenue to cluster-wide compromise. That scope change is why the score lands at 9.9 rather than in the 8-range.
The CISA SSVC decision points attached to the NVD record (NVD entry, enriched via CISA Vulnrichment) currently record exploitation as "none" and automatable as "no," with technical impact rated "total." The CVE does not appear in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation at this time, but the impact rating and the low bar for exploitation make it a priority for any operator running MCE in a shared-tenancy environment.
What's Vulnerable
- Vendor: Red Hat
- Product: Multicluster Engine for Kubernetes (
cpe:/a:redhat:multicluster_engine) - Package:
multicluster-engine/cluster-curator-controller-rhel9 - Default status: affected
Specific fixed version boundaries are not enumerated in the NVD record.
Patch Status
The NVD record was published 2026-08-12 with a vulnerability status of "Received," and no fix version or required-action deadline is listed there. Red Hat's advisory page and the associated Bugzilla entry are the authoritative places to track remediation as it ships. Operators should audit who currently holds create/update rights on ClusterCurator resources in the meantime.
Sources
- Red Hat Security Advisory; https://access.redhat.com/security/cve/CVE-2026-73268
- Red Hat Bugzilla #2514219; https://bugzilla.redhat.com/show_bug.cgi?id=2514219
- NVD, CVE-2026-73268 (CVSS vector, CPE, affected package, publication date, status), https://nvd.nist.gov/vuln/detail/CVE-2026-73268
- CISA Vulnrichment, SSVC decision points (exploitation, automatable, technical impact), https://github.com/cisagov/vulnrichment
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of 2026-08-12), https://www.cisa.gov/known-exploited-vulnerabilities-catalog