CVE-2026-73268— Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
Quick assessment
Affected
Red Hat multicluster engine for Kubernetes 2.10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Stolostron Cluster-Curator-Controller是Stolostron组织的一个管理云平台集群的控制器。 Stolostron Cluster-Curator-Controller存在代码注入漏洞，该漏洞源于CreateJob()函数在反序列化spec.install.overrideJob原始扩展时未验证用户控制的输入，导致注入的Job以控制器特权运行，可能导致任意代码执行和权限提升，并可能访问集群范围机密。
Possible ATT&CK Techniques 3 AI
T1611 · Escape to Host T1078.004 · Cloud Accounts T1136.003 · Cloud AccountAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.10 | 1787201612< * |
unaffected |
| Red Hat | multicluster engine for Kubernetes 2.11 | 1787238383< * |
unaffected |
| Red Hat | multicluster engine for Kubernetes 2.17 | 1786750700< * |
unaffected |
| Red Hat | multicluster engine for Kubernetes 2.6 | 1787264185< * |
unaffected |
| Red Hat | multicluster engine for Kubernetes 2.8 | 1787259011< * |
unaffected |
| Red Hat | multicluster engine for Kubernetes 2.9 | 1787201646< * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73268
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Stolostron Cluster-Curator-Controller 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Stolostron Cluster-Curator-Controller是Stolostron组织的一个管理云平台集群的控制器。 Stolostron Cluster-Curator-Controller存在代码注入漏洞，该漏洞源于CreateJob()函数在反序列化spec.install.overrideJob原始扩展时未验证用户控制的输入，导致注入的Job以控制器特权运行，可能导致任意代码执行和权限提升，并可能访问集群范围机密。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.10 | 1787201612 ~ * |
cpe:/a:redhat:multicluster_engine:2.10::el9
|
|
| Red Hat | multicluster engine for Kubernetes 2.11 | 1787238383 ~ * |
cpe:/a:redhat:multicluster_engine:2.11::el9
|
|
| Red Hat | multicluster engine for Kubernetes 2.17 | 1786750700 ~ * |
cpe:/a:redhat:multicluster_engine:2.17::el9
|
|
| Red Hat | multicluster engine for Kubernetes 2.6 | 1787264185 ~ * |
cpe:/a:redhat:multicluster_engine:2.6::el9
|
|
| Red Hat | multicluster engine for Kubernetes 2.8 | 1787259011 ~ * |
cpe:/a:redhat:multicluster_engine:2.8::el9
|
|
| Red Hat | multicluster engine for Kubernetes 2.9 | 1787201646 ~ * |
cpe:/a:redhat:multicluster_engine:2.9::el9
|
|
II. Public POCs for CVE-2026-73268
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73268
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73268 (7)
Other References for CVE-2026-73268 (1)
Same Patch Batch · Red Hat · 2026-08-12 · 19 CVEs total
| CVE-2026-72526 | 9.9 CRITICAL | Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant |
| CVE-2026-72508 | 9.9 CRITICAL | Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke servic |
| CVE-2026-73269 | 9.9 CRITICAL | Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger create |
| CVE-2026-70398 | 9.6 CRITICAL | Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamesp |
| CVE-2026-71471 | 9.0 CRITICAL | Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated |
| CVE-2026-13622 | 8.8 HIGH | Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allo |
| CVE-2026-71473 | 8.5 HIGH | Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables |
| CVE-2026-73122 | 7.7 HIGH | Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants eve |
| CVE-2026-66878 | 7.7 HIGH | Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferenc |
| CVE-2026-19654 | 7.5 HIGH | Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can all |
| CVE-2026-71469 | 7.5 HIGH | Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticate |
| CVE-2026-18726 | 6.5 MEDIUM | Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing |
| CVE-2026-18727 | 6.5 MEDIUM | Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing |
| CVE-2026-71846 | 6.5 MEDIUM | Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch b |
| CVE-2026-64927 | 6.4 MEDIUM | Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and con |
| CVE-2026-18663 | 5.9 MEDIUM | 389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() |
| CVE-2026-19130 | 5.8 MEDIUM | Provider-credential-controller: provider-credential-controller: cross-namespace credential |
| CVE-2026-19548 | 5.5 MEDIUM | Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processi |
IV. Related Vulnerabilities
Same product: multicluster engine for Kubernetes 2.10
-
CVE-2026-73267
Clusterclaims-controller: managedcluster deletion keyed sole -
CVE-2026-75569
Mce-operator-bundle: all github actions pinned by mutable ta -
CVE-2026-66794
Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ss -
CVE-2026-66795
Managedcluster-import-controller: csr auto-approver does not -
CVE-2026-73266
Clusterclaims-controller: confused deputy: tenant-controlled
Same vendor: Red Hat
-
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentic -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50
Same weakness: CWE-94
-
CVE-2026-92084
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Ar -
CVE-2026-100157
WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shor -
CVE-2026-103519
WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Ar -
CVE-2026-100152
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcod -
CVE-2026-92536
Paid Membership Plugin, Ecommerce, User Registration Form, L
V. Comments for CVE-2026-73268
No comments yet