CVE-2026-73268

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73268", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-11T17:22:38.645Z", "datePublished": "2026-08-12T19:05:12.287Z", "dateUpdated": "2026-09-29T19:41:40.747Z"}, "containers": {"cna": {"title": "Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets."}], "affected": [{"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787201612", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787238383", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786750700", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787264185", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787259011", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787201646", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "name": "RHSA-2026:59556", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "name": "RHSA-2026:59557", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "name": "RHSA-2026:59558", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "name": "RHSA-2026:59559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "name": "RHSA-2026:59579", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59593", "name": "RHSA-2026:59593", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-73268", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514219", "name": "RHBZ#2514219", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-11T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "workarounds": [{"lang": "en", "value": "To mitigate this issue, implement strict Role-Based Access Control (RBAC) policies to limit create and update permissions on `clustercurators.cluster.open-cluster-management.io` resources to trusted administrators only. This restricts the ability of less privileged tenants to exploit the vulnerability and escalate privileges within the Kubernetes environment."}], "timeline": [{"lang": "en", "time": "2026-08-10T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-29T19:41:40.747Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T19:45:32.285133Z", "id": "CVE-2026-73268", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T19:45:37.611Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T19:45:32.285133Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T19:45:35.347Z"}}], "cna": {"title": "Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.10", "versions": [{"status": "unaffected", "version": "1787201612", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787238383", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1786750700", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "versions": [{"status": "unaffected", "version": "1787264185", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "versions": [{"status": "unaffected", "version": "1787259011", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "versions": [{"status": "unaffected", "version": "1787201646", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-08-10T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-08-11T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "name": "RHSA-2026:59556", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "name": "RHSA-2026:59557", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "name": "RHSA-2026:59558", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "name": "RHSA-2026:59559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "name": "RHSA-2026:59579", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59593", "name": "RHSA-2026:59593", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-73268", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514219", "name": "RHBZ#2514219", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, implement strict Role-Based Access Control (RBAC) policies to limit create and update permissions on `clustercurators.cluster.open-cluster-management.io` resources to trusted administrators only. This restricts the ability of less privileged tenants to exploit the vulnerability and escalate privileges within the Kubernetes environment."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-29T19:41:40.747Z"}, "x_redhatCweChain": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}}, "cveMetadata": {"cveId": "CVE-2026-73268", "state": "PUBLISHED", "dateUpdated": "2026-09-29T19:41:40.747Z", "dateReserved": "2026-08-11T17:22:38.645Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-12T19:05:12.287Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787201612", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787238383", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786750700", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787264185", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787259011", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "product": "multicluster engine for Kubernetes 2.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787201646", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el componente cluster-curator-controller del motor multicl\u00faster (MCE). Un inquilino con permisos de creaci\u00f3n o actualizaci\u00f3n en los recursos ClusterCurator puede inyectar una especificaci\u00f3n de Job arbitraria. Esto es posible porque la funci\u00f3n CreateJob() no valida la entrada controlada por el usuario al deserializar la extensi\u00f3n raw spec.install.overrideJob. La explotaci\u00f3n exitosa permite que el Job inyectado se ejecute con los privilegios elevados del controlador, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario y escalada de privilegios, potencialmente accediendo a secretos de todo el cl\u00faster."}], "id": "CVE-2026-73268", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73268", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T19:45:32.285133Z", "version": "2.0.3"}}]}, "published": "2026-08-12T20:17:53.650", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59556"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59557"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59558"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59559"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59579"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59593"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-73268"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514219"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cluster-curator-controller: cluster-curator-controller: spec.install.overrideJob allows arbitrary Job spec injection", "id": "2514219", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514219"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, implement strict Role-Based Access Control (RBAC) policies to limit create and update permissions on `clustercurators.cluster.open-cluster-management.io` resources to trusted administrators only. This restricts the ability of less privileged tenants to exploit the vulnerability and escalate privileges within the Kubernetes environment."}, "name": "CVE-2026-73268", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/cluster-curator-controller-rhel9", "product_name": "Multicluster Engine for Kubernetes"}], "public_date": "2026-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73268\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73268"], "statement": "This Critical flaw in the multicluster engine's `cluster-curator-controller` allows a tenant with create/update permissions on `ClusterCurator` resources to achieve arbitrary code execution with elevated privileges. The vulnerability stems from insufficient validation of the `spec.install.overrideJob` field, enabling injection of malicious Job specifications that run with the controller's highly privileged ServiceAccount, potentially exposing cluster-wide secrets and managed cluster access.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Multicluster Engine for Kubernetes", "source": "cna", "vendor": "Red Hat"}, "product": "multicluster_engine_for_kubernetes", "vendor": "redhat"}], "created": "2026-08-12T23:30:10.477191+00:00", "updated": "2026-08-13T02:30:12.258646+00:00", "vendors": ["redhat", "redhat$PRODUCT$multicluster_engine_for_kubernetes"]}