Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73267— Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

Quick assessment

Affected
Red Hat multicluster engine for Kubernetes 2.10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Stolostron clusterclaims-controller是Stolostron组织的一款企业云平台的集群声明控制器。 Stolostron clusterclaims-controller存在处理逻辑错误漏洞，该漏洞源于缺少所有权检查，导致具有标准权限的租户可通过操纵spec.namespace字段删除任意ManagedCluster，包括hub的local-cluster或其他租户的集群，从而引发拒绝服务。

CVSS 7.7 · High EPSS 0.63% · P48

Affected Version Matrix 6

VendorProduct Version RangeStatus
Red Hat multicluster engine for Kubernetes 2.10 1787196014< * unaffected
Red Hat multicluster engine for Kubernetes 2.11 1787239442< * unaffected
Red Hat multicluster engine for Kubernetes 2.17 1786577950< * unaffected
Red Hat multicluster engine for Kubernetes 2.6 1787259112< * unaffected
Red Hat multicluster engine for Kubernetes 2.8 1787259059< * unaffected
Red Hat multicluster engine for Kubernetes 2.9 1787195995< * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73267

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
服务端安全的客户端实施
Source: CVE Program / CVE List V5
Vulnerability Title
Stolostron clusterclaims-controller 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Stolostron clusterclaims-controller是Stolostron组织的一款企业云平台的集群声明控制器。 Stolostron clusterclaims-controller存在处理逻辑错误漏洞，该漏洞源于缺少所有权检查，导致具有标准权限的租户可通过操纵spec.namespace字段删除任意ManagedCluster，包括hub的local-cluster或其他租户的集群，从而引发拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat multicluster engine for Kubernetes 2.10 1787196014 ~ * cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat multicluster engine for Kubernetes 2.11 1787239442 ~ * cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat multicluster engine for Kubernetes 2.17 1786577950 ~ * cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat multicluster engine for Kubernetes 2.6 1787259112 ~ * cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat multicluster engine for Kubernetes 2.8 1787259059 ~ * cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat multicluster engine for Kubernetes 2.9 1787195995 ~ * cpe:/a:redhat:multicluster_engine:2.9::el9

II. Public POCs for CVE-2026-73267

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73267

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-73267 (6)

Other References for CVE-2026-73267 (2)

IV. Related Vulnerabilities

Same product: multicluster engine for Kubernetes 2.10
Same vendor: Red Hat
Same weakness: CWE-602

V. Comments for CVE-2026-73267

No comments yet

Leave a comment