REDHAT-BUG-2514219: High severity multicluster engine (MCE) - cluster-curator-controller vulnerability
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). The CreateJob() function unmarshals the user-controlled spec.install.overrideJob raw extension into a batchv1.Job and creates it using the controller's privileged ServiceAccount without validating the image, command, serviceAccountName, hostNetwork, or volumes fields. The CRD field uses PreserveUnknownFields RawExtension with no CEL or webhook validation. A tenant with create/update permissions on ClusterCurator resources can inject an arbitrary Job specification that runs with the controller's elevated privileges, including the cluster-installer ServiceAccount that holds cluster-wide secrets and managed cluster access.
Upstream repo: https://github.com/stolostron/cluster-curator-controller Audited commit: 0e050d6e5edf5d2fbc2794fa468bdffd056b444f Jira tracker: ACM-38728
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2514219?
The severity of REDHAT-BUG-2514219 is rated high with a score of 7.
What is REDHAT-BUG-2514219?
REDHAT-BUG-2514219 refers to a flaw in the cluster-curator-controller component of multicluster engine that involves improper validation of user-controlled input.
How can I fix REDHAT-BUG-2514219?
To fix REDHAT-BUG-2514219, ensure proper validation of the image used in the CreateJob() function within the cluster-curator-controller.
What are the implications of REDHAT-BUG-2514219?
The implications of REDHAT-BUG-2514219 include potential unauthorized execution of arbitrary jobs due to the lack of validation.
When was REDHAT-BUG-2514219 published?
REDHAT-BUG-2514219 was published on August 11, 2026.