A critical privilege escalation flaw in Red Hat Multicluster Engine for Kubernetes permits local users to elevate access to cluster-wide administrative control.

This vulnerability resides in the cluster-curator-controller component, where insufficient validation of resource names allows an authenticated local user to trigger the creation of a cluster-scoped ClusterRoleBinding. By utilizing a specific naming convention during the creation of a ClusterCurator resource, an attacker can trick the system into granting elevated permissions.

The vulnerability carries a CVSS score of 9.9, reflecting its critical potential for total system compromise. A successful exploit allows a user with restricted namespace access to gain administrative control over the entire cluster. This impact includes unauthorized access to sensitive secrets, the ability to modify cluster configurations, and the potential to delete hosted clusters or node pools, leading to significant operational disruption and data exposure.

Immediate Action: Review the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-73269 and apply the latest available updates for the Multicluster Engine for Kubernetes.

Proactive Monitoring: Audit Kubernetes access logs for unusual ClusterCurator resource creation patterns or unexpected cluster-scoped role binding activity.

Compensating Controls: Implement strict Kubernetes RBAC policies to limit who can create or modify ClusterCurator resources until the patch can be applied.

Public Exploit Available: Unknown

Given the critical CVSS score and the potential for complete cluster takeover, organizations should treat this vulnerability as a high priority. Administrators must prioritize the application of vendor-supplied patches and conduct a thorough review of existing cluster role bindings to ensure no unauthorized escalations have already occurred.