CVE-2026-73269: Improper Privilege Management in Red Hat multicluster engine for Kubernetes 2.10

The vulnerability exists in the cluster-curator-controller component of Red Hat multicluster engine for Kubernetes 2.10. By creating a ClusterCurator resource with a crafted naming convention, a local user can cause the creation of a cluster-scoped ClusterRoleBinding, effectively escalating their privileges from namespace-local to cluster-wide control. This escalation grants the attacker extensive permissions such as accessing and manipulating secrets, managing cluster operations, and deleting hosted clusters or node pools. The issue is tracked as CVE-2026-73269 with a CVSS 3.1 score of 9.9, indicating critical severity. Red Hat has addressed this vulnerability in the multicluster engine for Kubernetes v2.11.6 release with updated container images and security fixes.

Successful exploitation allows a local user to escalate privileges from namespace-level access to cluster-wide control, granting broad permissions including secret access, cluster management, and deletion capabilities. This can lead to full compromise of the Kubernetes cluster managed by the multicluster engine.

Red Hat has released updated multicluster engine for Kubernetes images in version 2.11.6 that include security fixes addressing this vulnerability. Users should upgrade to version 2.11.6 or later to remediate this issue. Refer to Red Hat's official documentation for installation and upgrade instructions. No other temporary mitigations or workarounds are specified.