CVE-2026-73268: Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.
Other sources
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). The CreateJob() function unmarshals the user-controlled spec.install.overrideJob raw extension into a batchv1.Job and creates it using the controller's privileged ServiceAccount without validating the image, command, serviceAccountName, hostNetwork, or volumes fields. The CRD field uses PreserveUnknownFields RawExtension with no CEL or webhook validation. A tenant with create/update permissions on ClusterCurator resources can inject an arbitrary Job specification that runs with the controller's elevated privileges, including the cluster-installer ServiceAccount that holds cluster-wide secrets and managed cluster access.
Upstream repo: https://github.com/stolostron/cluster-curator-controller Audited commit: 0e050d6e5edf5d2fbc2794fa468bdffd056b444f Jira tracker: ACM-38728
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73268?
The severity of CVE-2026-73268 is critical with a score of 9.9.
How do I fix CVE-2026-73268?
To fix CVE-2026-73268, ensure that you update the multicluster engine (MCE) to the latest patched version.
What kind of vulnerability is CVE-2026-73268?
CVE-2026-73268 is classified as a code injection vulnerability.
Who is affected by CVE-2026-73268?
Tenants with create or update permissions on ClusterCurator resources are affected by CVE-2026-73268.
What can an attacker do with CVE-2026-73268?
An attacker can inject arbitrary Job specifications due to the lack of validation in the CreateJob() function.