This vulnerability exists in the cluster-curator-controller component of Red Hat Multicluster Engine for Kubernetes. By creating a ClusterCurator resource with a mismatched name and namespace, a local user can cause the creation of a cluster-scoped ClusterRoleBinding. This binding grants cluster-wide permissions, enabling privilege escalation from namespace-local access to full cluster control. The elevated privileges include managing secrets, cluster actions, and deleting hosted clusters or node pools. The issue bypasses existing admission controls and poses a significant risk to cluster security and data integrity in Red Hat OpenShift environments deploying MCE. The vulnerability is tracked as CVE-2026-73269 with a CVSS v3.1 score of 9.9 (critical).

The vulnerability allows a local user with namespace-local access to escalate privileges to cluster-wide control. This includes the ability to access and manipulate secrets, manage cluster operations, and delete hosted clusters or node pools. Such broad permissions compromise the confidentiality, integrity, and availability of the Kubernetes cluster environment, posing a critical security risk.

Red Hat advises restricting the ability to create ClusterCurator resources by implementing Kubernetes RBAC policies that limit create permissions for clustercurators.cluster.open-cluster-management.io to trusted administrators or service accounts only. Alternatively, deploying an admission controller to enforce that the metadata.name and metadata.namespace fields are identical when creating ClusterCurator resources can prevent the vulnerability. No official patch or fix is currently confirmed; users should apply these mitigations until a fix is released. Check the Red Hat advisory for updates: https://access.redhat.com/security/cve/CVE-2026-73269