CVE-2026-10059: Incorrect Privilege Assignment in Red Hat multicluster engine for Kubernetes 2.1

CVE-2026-10059 is a privilege escalation vulnerability in the Multicluster Engine for Kubernetes ClusterCurator controller. It allows a tenant administrator with namespace-scoped privileges to create a namespaced ClusterCurator, which mistakenly grants the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This flaw enables the tenant administrator to escalate privileges and gain full control over the Kubernetes cluster. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Red Hat has published security advisories (RHSA-2026:59556 and RHSA-2026:59557) that provide updated container images and instructions for installation but do not explicitly state a fixed version or patch. The advisories emphasize the importance of updating to the latest multicluster engine images to mitigate security risks.

Successful exploitation of this vulnerability allows a tenant administrator with limited namespace-scoped privileges to escalate their privileges to cluster-wide administrative level. This grants full control over the Kubernetes cluster, including the ability to mint tokens for ServiceAccounts with cluster-admin rights, potentially compromising the entire cluster's security and operations.

Red Hat has issued security advisories recommending updating to the latest multicluster engine for Kubernetes images. Users should follow the official Red Hat documentation for installing updated images to mitigate this vulnerability. No explicit patch version is stated, so users must ensure they deploy the latest available images as per Red Hat's guidance. There is no indication that the vulnerability is already mitigated or requires no action; therefore, applying the updated images is the recommended remediation.