A critical code injection flaw in Red Hat Multicluster Engine for Kubernetes permits authenticated tenants to execute arbitrary code with elevated privileges.

The vulnerability originates in the CreateJob() function of the cluster-curator-controller, which fails to validate user-controlled input when unmarshaling the spec.install.overrideJob extension. An authenticated tenant with permissions to create or update ClusterCurator resources can inject a malicious Job specification, which the controller then executes with its own highly privileged service account.

The CVSS score of 9.9 underscores the severity of this code injection flaw. Successful exploitation results in arbitrary code execution with the privileges of the controller, providing an attacker with nearly unrestricted access to cluster-wide resources and secrets. This represents a total loss of confidentiality, integrity, and availability for the affected Kubernetes environment.

Immediate Action: Review the official security guidance at https://access.redhat.com/security/cve/CVE-2026-73268 and update the Multicluster Engine for Kubernetes to the latest patched version.

Proactive Monitoring: Inspect audit logs for irregular Job creation activity or unexpected processes spawned by the cluster-curator-controller.

Compensating Controls: Apply strict RBAC controls to limit which users can create or update ClusterCurator resources, minimizing the attack surface.

Public Exploit Available: Unknown

Given the potential for complete cluster compromise, this vulnerability demands immediate attention. Organizations should prioritize updating the affected software and auditing current user permissions to ensure that only trusted individuals can interact with the vulnerable controller components.