9.1Critical
CVE-2026-10059Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token
Description
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.
Weakness (CWE):
CWE-266
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| multicluster engine | 2.10 | — | |
| multicluster engine | 2.11 | — | |
| multicluster engine | 2.6 | — | |
| multicluster engine | 2.8 | — | |
| multicluster engine | 2.9 | — | |
| Red Hat | multicluster engine for Kubernetes 2.1 | all versions | |
| Red Hat | multicluster engine for Kubernetes 2.11 | all versions | |
| Red Hat | multicluster engine for Kubernetes 2.6 | all versions | |
| Red Hat | multicluster engine for Kubernetes 2.8 | all versions | |
| Red Hat | multicluster engine for Kubernetes 2.9 | all versions |
References and patches
- RHSA-2026:59556 vendor-advisory
- RHSA-2026:59557 vendor-advisory
- RHSA-2026:59558 vendor-advisory
- RHSA-2026:59559 vendor-advisory
- RHSA-2026:59579 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-10059 vdb-entry
- RHBZ#2483187 issue-tracking