CVE-2026-73267 is a security flaw in the clusterclaims-controller component of the multicluster engine (MCE) for Kubernetes. A tenant with standard create and delete permissions on ClusterClaim resources can exploit a missing ownership check by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters. The vulnerability results in a denial of service by enabling unauthorized deletion of ManagedClusters. The issue is classified under CWE-602 (Client-Side Enforcement of Server-Side Security). The CVSS v3.1 base score is 7.7 (high severity), with an attack vector of network, low attack complexity, low privileges required, no user interaction, and scope changed. The impact is high availability impact with no confidentiality or integrity impact. According to the Red Hat advisory, no effective mitigation or patch currently meets their criteria for ease of use, applicability, or stability.

This vulnerability allows an attacker with standard permissions on ClusterClaim resources to delete any ManagedCluster, including critical clusters such as the hub's local-cluster or other tenants' clusters. This unauthorized deletion can cause denial of service by disrupting cluster availability. There is no impact on confidentiality or integrity, but the availability impact is high.

According to the Red Hat advisory, no mitigation or patch currently meets the criteria for deployment ease, applicability, or stability. Users should monitor Red Hat advisories for updates on fixes or mitigations. Until a fix is available, restricting permissions to create and delete ClusterClaim resources to trusted users only is recommended as a precautionary measure.