CVE-2026-73268

{"id": "CVE-2026-73268", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73268", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T19:45:32.285133Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.10", "versions": [{"status": "unaffected", "version": "1787201612", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787238383", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1786750700", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "versions": [{"status": "unaffected", "version": "1787264185", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "versions": [{"status": "unaffected", "version": "1787259011", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "versions": [{"status": "unaffected", "version": "1787201646", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-12T20:17:53.650", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59593", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-73268", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514219", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el componente cluster-curator-controller del motor multicl\u00faster (MCE). Un inquilino con permisos de creaci\u00f3n o actualizaci\u00f3n en los recursos ClusterCurator puede inyectar una especificaci\u00f3n de Job arbitraria. Esto es posible porque la funci\u00f3n CreateJob() no valida la entrada controlada por el usuario al deserializar la extensi\u00f3n raw spec.install.overrideJob. La explotaci\u00f3n exitosa permite que el Job inyectado se ejecute con los privilegios elevados del controlador, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario y escalada de privilegios, potencialmente accediendo a secretos de todo el cl\u00faster."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "secalert@redhat.com"}