Multicluster Engine for Kubernetes — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in Multicluster Engine for Kubernetes, with AI-generated Chinese analysis, references, and POCs.

Vendor: Red Hat

CVE ID	Title	CVSS	Severity	Published
CVE-2026-73266	Clusterclaims-controller: clusterclaims-controller: tenant-controlled clusterclaim labels propagated to managedcluster enabling cross-tenant managedclusterset join CWE-441	7.1	High	2026-08-13
CVE-2026-19130	Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization CWE-639	5.8	Medium	2026-08-12
CVE-2026-73268	Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection CWE-94	9.9	Critical	2026-08-12
CVE-2026-73269	Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa CWE-269	9.9	Critical	2026-08-12
CVE-2026-10059	Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token CWE-266	9.1	Critical	2026-08-05
CVE-2026-10805	Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend CWE-78	6.7	Medium	2026-06-04
CVE-2026-10101	Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users CWE-201	6.3	Medium	2026-05-29
CVE-2025-57851	Mce: privilege escalation via excessive /etc/passwd permissions CWE-276	6.4	Medium	2026-04-08

All 8 known CVE vulnerabilities affecting Multicluster Engine for Kubernetes with full Chinese analysis, references, and POCs where available.