CVE-2026-73269: Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). When a ClusterCurator resource is created with metadata.name different from metadata.namespace, the ApplyRBACHypershift function creates a RoleBinding in an arbitrary namespace (specified by curator.Name) and a cluster-scoped ClusterRoleBinding (curator-crb), both binding the tenant's namespace-local cluster-installer ServiceAccount to the curator ClusterRole. This ClusterRole grants cluster-wide secrets:get/create, managedclusteractions:, and hostedclusters/nodepools/managedclusters delete permissions. A tenant can escalate from namespace-local access to cluster-wide privileges with no admission controls.
Upstream repo: https://github.com/stolostron/cluster-curator-controller Audited commit: 0e050d6e5edf5d2fbc2794fa468bdffd056b444f Jira tracker: ACM-38729
Other sources
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73269?
The severity of CVE-2026-73269 is rated as critical with a score of 9.9.
How do I fix CVE-2026-73269?
To mitigate CVE-2026-73269, it is recommended to upgrade the cluster-curator-controller to the latest version where the vulnerability is addressed.
What impact does CVE-2026-73269 have on security?
CVE-2026-73269 allows a local user to escalate privileges and gain cluster-wide access to secrets, which poses a significant security risk.
Who is affected by CVE-2026-73269?
CVE-2026-73269 affects environments using the cluster-curator-controller where unauthorized users can exploit the vulnerability.
What is the attack vector for CVE-2026-73269?
The attack vector for CVE-2026-73269 is local, as it requires a user to create a ClusterCurator resource with a specific naming convention.