Skip to content
Fencer Vulns
critical 9.9

CVE-2026-73268 json

Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

published 2026-08-12 2 mo ago modified 2026-10-24 15 d ago also EUVD-2026-57442

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.

Patch / fix

  • Red Hat multicluster engine for Kubernetes 2.10 1787201612
  • Red Hat multicluster engine for Kubernetes 2.11 1787238383
  • Red Hat multicluster engine for Kubernetes 2.17 1786750700
  • Red Hat multicluster engine for Kubernetes 2.6 1787264185
  • Red Hat multicluster engine for Kubernetes 2.8 1787259011
  • Red Hat multicluster engine for Kubernetes 2.9 1787201646

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-73268 updated cvss 9.9

cluster-curator-controller: cluster-curator-controller: spec.install.overrideJob allows arbitrary Job spec injection

  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/cluster-curator-controller-rhel9 1787264185
    fixed: vendor fix RHSA-2026:59579
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/cluster-curator-controller-rhel9 1787259011
    fixed: vendor fix RHSA-2026:59558
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/cluster-curator-controller-rhel9 1787201646
    fixed: vendor fix RHSA-2026:59559
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/cluster-curator-controller-rhel9 1787201612
    fixed: vendor fix RHSA-2026:59557
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/cluster-curator-controller-rhel9 1787238383
    fixed: vendor fix RHSA-2026:59556
  • Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/cluster-curator-controller-rhel9 1786750700
    fixed: vendor fix RHSA-2026:59593
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hive-rhel9 1787291123, multicluster-engine/work-rhel9 1787263188, multicluster-engine/discovery-rhel9 1787263531, multicluster-engine/placement-rhel9 1787260699, multicluster-engine/console-mce-rhel9 1787264250, multicluster-engine/must-gather-rhel9 1787264198, +20 more Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hive-rhel9 1787291250, multicluster-engine/work-rhel9 1787259113, multicluster-engine/discovery-rhel9 1787259074, multicluster-engine/placement-rhel9 1787259108, multicluster-engine/console-mce-rhel9 1787259048, multicluster-engine/must-gather-rhel9 1787258992, +20 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hive-rhel9 1787205132, multicluster-engine/work-rhel9 1786933545, multicluster-engine/discovery-rhel9 1786658519, multicluster-engine/placement-rhel9 1786491555, multicluster-engine/console-mce-rhel9 1787079359, multicluster-engine/must-gather-rhel9 1786837240, +23 more Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/hive-rhel9 1787205371, multicluster-engine/work-rhel9 1786933256, multicluster-engine/discovery-rhel9 1787071404, multicluster-engine/placement-rhel9 1786548467, multicluster-engine/console-mce-rhel9 1787079364, multicluster-engine/must-gather-rhel9 1786548899, +24 more Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hive-rhel9 1787291933, multicluster-engine/work-rhel9 1786907276, multicluster-engine/discovery-rhel9 1786911975, multicluster-engine/placement-rhel9 1786911984, multicluster-engine/console-mce-rhel9 1787065052, multicluster-engine/must-gather-rhel9 1786911926, +25 more Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/hive-rhel9 1787033495, multicluster-engine/work-rhel9 1786933423, multicluster-engine/maestro-rhel9 1786985023, multicluster-engine/discovery-rhel9 1786681989, multicluster-engine/placement-rhel9 1786983381, multicluster-engine/console-mce-rhel9 1786668856, +28 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Red Hat multicluster engine for Kubernetes 2.10
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.17
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.