CVE-2026-73267: Client-Side Enforcement of Server-Side Security in Red Hat multicluster engine for Kubernetes 2.10

The vulnerability exists in the clusterclaims-controller of Red Hat multicluster engine (MCE) for Kubernetes 2.10. A tenant with standard create and delete permissions on ClusterClaim resources can exploit a missing ownership check by manipulating the spec.namespace field. This allows deletion of any ManagedCluster, including the hub's local-cluster or other tenants' clusters, resulting in a denial of service. The flaw is categorized under CWE-602 (Client-Side Enforcement of Server-Side Security). The CVSS v3.1 score is 7.7 (High) with network attack vector, low complexity, low privileges required, no user interaction, changed scope, no confidentiality or integrity impact, and high availability impact.

This vulnerability enables unauthorized deletion of critical ManagedClusters, including the hub's local-cluster and other tenants' clusters, leading to denial of service. There is no confidentiality or integrity impact, but the availability of cluster resources is severely affected. Exploitation requires only standard permissions on ClusterClaim resources and can be performed remotely over the network.

As per the Red Hat advisory, no effective mitigation or patch is currently available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's official advisories for updates and consider restricting permissions on ClusterClaim resource operations as a temporary measure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.