CVE-2026-10059

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10059", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-05-29T08:14:22.495Z", "datePublished": "2026-08-05T08:54:51.726Z", "dateUpdated": "2026-09-08T12:18:44.040Z"}, "containers": {"cna": {"title": "Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster."}], "affected": [{"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787201612", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787238383", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787264185", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787259011", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787201646", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "name": "RHSA-2026:59556", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "name": "RHSA-2026:59557", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "name": "RHSA-2026:59558", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "name": "RHSA-2026:59559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "name": "RHSA-2026:59579", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-10059", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483187", "name": "RHBZ#2483187", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-05T08:35:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-266: Incorrect Privilege Assignment", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-05-06T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-05T08:35:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-08T12:18:44.040Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T14:21:58.044319Z", "id": "CVE-2026-10059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T14:26:49.274Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T14:21:58.044319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T14:22:38.510Z"}}], "cna": {"title": "Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token", "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "versions": [{"status": "unaffected", "version": "1787201612", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787238383", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "versions": [{"status": "unaffected", "version": "1787264185", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "versions": [{"status": "unaffected", "version": "1787259011", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "versions": [{"status": "unaffected", "version": "1787201646", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-06T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-05T08:35:00.000Z", "value": "Made public."}], "datePublic": "2026-08-05T08:35:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "name": "RHSA-2026:59556", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "name": "RHSA-2026:59557", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "name": "RHSA-2026:59558", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "name": "RHSA-2026:59559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "name": "RHSA-2026:59579", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-10059", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483187", "name": "RHBZ#2483187", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-08T12:18:44.040Z"}, "x_redhatCweChain": "CWE-266: Incorrect Privilege Assignment"}}, "cveMetadata": {"cveId": "CVE-2026-10059", "state": "PUBLISHED", "dateUpdated": "2026-09-08T12:18:44.040Z", "dateReserved": "2026-05-29T08:14:22.495Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-05T08:54:51.726Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787201612", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787238383", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787264185", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787259011", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787201646", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el controlador ClusterCurator de Multicluster Engine para Kubernetes. Un administrador de inquilinos con privilegios de \u00e1mbito de espacio de nombres puede explotar esta vulnerabilidad al crear un ClusterCurator con \u00e1mbito de espacio de nombres. Esta acci\u00f3n otorga inadvertidamente al administrador de inquilinos la capacidad de acu\u00f1ar un token para una ServiceAccount con autoridad administrativa de \u00e1mbito de cl\u00faster. Esto conduce a una escalada de privilegios, lo que permite al administrador de inquilinos obtener control total sobre el cl\u00faster."}], "id": "CVE-2026-10059", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10059", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T14:21:58.044319Z", "version": "2.0.3"}}]}, "published": "2026-08-05T09:18:13.720", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59556"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59557"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59558"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59559"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59579"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-10059"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483187"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue.", "bugzilla": {"description": "cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via ClusterCurator ServiceAccount token", "id": "2483187", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483187"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-10059", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/cluster-curator-controller-rhel9", "product_name": "Multicluster Engine for Kubernetes"}], "public_date": "2026-08-05T08:35:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-10059\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-10059"], "statement": "This is an Important privilege escalation flaw in Multicluster Engine for Kubernetes. A namespace-scoped tenant administrator can achieve cluster-wide administrative authority by leveraging the ClusterCurator controller's creation of cluster-scoped RBAC for a ServiceAccount within a tenant-controlled namespace. This allows the tenant to mint a token for the controller-created ServiceAccount, granting full control over the cluster.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Multicluster Engine for Kubernetes", "source": "cna", "vendor": "Red Hat"}, "product": "multicluster_engine_for_kubernetes", "vendor": "redhat"}], "created": "2026-08-05T11:00:11.329160+00:00", "updated": "2026-08-05T11:00:12.089930+00:00", "vendors": ["redhat", "redhat$PRODUCT$multicluster_engine_for_kubernetes"]}