CVE-2026-73266
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Summary
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
Workarounds
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References
- https://access.redhat.com/security/cve/CVE-2026-73266
- https://bugzilla.redhat.com/show_bug.cgi?id=2514217
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.