Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T08:35:00 cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via ClusterCurator ServiceAccount token 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CWE-266

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

This is an Important privilege escalation flaw in Multicluster Engine for Kubernetes. A namespace-scoped tenant administrator can achieve cluster-wide administrative authority by leveraging the ClusterCurator controller's creation of cluster-scoped RBAC for a ServiceAccount within a tenant-controlled namespace. This allows the tenant to mint a token for the controller-created ServiceAccount, granting full control over the cluster. Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. multicluster engine for Kubernetes 2.1 2026-08-25T00:00:00Z RHSA-2026:59557 multicluster-engine/cluster-curator-controller-rhel9:1787201612 multicluster engine for Kubernetes 2.11 2026-08-25T00:00:00Z RHSA-2026:59556 multicluster-engine/cluster-curator-controller-rhel9:1787238383 multicluster engine for Kubernetes 2.6 2026-08-25T00:00:00Z RHSA-2026:59579 multicluster-engine/cluster-curator-controller-rhel9:1787264185 multicluster engine for Kubernetes 2.8 2026-08-25T00:00:00Z RHSA-2026:59558 multicluster-engine/cluster-curator-controller-rhel9:1787259011 multicluster engine for Kubernetes 2.9 2026-08-25T00:00:00Z RHSA-2026:59559 multicluster-engine/cluster-curator-controller-rhel9:1787201646 https://www.cve.org/CVERecord?id=CVE-2026-10059 https://nvd.nist.gov/vuln/detail/CVE-2026-10059