CVE-2026-73266: Unintended Proxy or Intermediary ('Confused Deputy') in Red Hat multicluster engine for Kubernetes 2.10

This vulnerability involves an unintended proxy or intermediary ('Confused Deputy') flaw in the clusterclaims-controller component of the multicluster engine for Kubernetes. Authenticated tenants can exploit this by manipulating ClusterClaim labels, causing clusters to join ManagedClusterSets of other tenants. This can lead to unauthorized policy and workload injection across tenant boundaries. The issue affects multicluster engine for Kubernetes 2.10. Red Hat has issued a security advisory (RHSA-2026:59556) and released updated images in version 2.11.6 to fix the problem.

Exploitation allows an authenticated tenant to gain unauthorized access to other tenants' clusters by forcing cluster membership changes. This can result in injection of policies and workloads into clusters managed by other tenants, potentially compromising confidentiality and integrity of those clusters. The CVSS score of 7.1 reflects high impact on confidentiality and limited impact on integrity, with no impact on availability.

Red Hat has released updated multicluster engine for Kubernetes images in version 2.11.6 that include security fixes for this vulnerability. Users should upgrade to version 2.11.6 or later to remediate the issue. Refer to the Red Hat advisory RHSA-2026:59556 and official documentation for upgrade instructions. No other mitigation or temporary workaround is indicated by the vendor advisory.