CVE-2026-10059: Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-05 · updated 2026-10-23
Weakness: CWE-266

Description

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

Affected products

Red Hat multicluster engine for Kubernetes 2.1: all versions — fixed in 1787201612
Red Hat multicluster engine for Kubernetes 2.11: all versions — fixed in 1787238383
Red Hat multicluster engine for Kubernetes 2.6: all versions — fixed in 1787264185
Red Hat multicluster engine for Kubernetes 2.8: all versions — fixed in 1787259011
Red Hat multicluster engine for Kubernetes 2.9: all versions — fixed in 1787201646

How to fix

Upgrade to a fixed version: Red Hat multicluster engine for Kubernetes 2.1 1787201612; Red Hat multicluster engine for Kubernetes 2.11 1787238383; Red Hat multicluster engine for Kubernetes 2.6 1787264185; Red Hat multicluster engine for Kubernetes 2.8 1787259011; Red Hat multicluster engine for Kubernetes 2.9 1787201646. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-10059 or the next vulnerability affects your stack