CVE-2026-73267: Client-Side Enforcement of Server-Side Security in Red Hat multicluster engine for Kubernetes 2.10

CVE-2026-73267 is a security flaw in the clusterclaims-controller component of Red Hat multicluster engine for Kubernetes. It allows a tenant with standard permissions to create and delete ClusterClaim resources to exploit a missing ownership check by manipulating the spec.namespace field. This manipulation permits the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or clusters belonging to other tenants. The vulnerability results in a denial of service condition by enabling unauthorized deletion of managed clusters. The CVSS v3.1 score is 7.7 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, no confidentiality or integrity impact, but high availability impact.

The vulnerability allows unauthorized deletion of ManagedClusters, including critical clusters such as the hub's local-cluster or other tenants' clusters. This can cause denial of service by disrupting the centralized management of Kubernetes clusters, potentially impacting cluster availability and operations.

Red Hat has released a security advisory (RHSA-2026:59556) indicating that a security update is available in multicluster engine for Kubernetes v2.11 general availability release images, which include security fixes. Users should upgrade to the fixed versions provided by Red Hat. Detailed installation instructions and updated images are available in Red Hat's documentation. Patch status is confirmed as fixed in versions starting from 2.11. Users should apply these updates to remediate the vulnerability.