CVE-2026-73266CWE-441

CVE-2026-73266

High · published August 13, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Weakness
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')
Published
2026-08-13T21:17Z
References (8)
https://access.redhat.com/errata/RHSA-2026:59556 · [email protected]https://access.redhat.com/errata/RHSA-2026:59557 · [email protected]https://access.redhat.com/errata/RHSA-2026:59558 · [email protected]https://access.redhat.com/errata/RHSA-2026:59559 · [email protected]https://access.redhat.com/errata/RHSA-2026:59579 · [email protected]https://access.redhat.com/errata/RHSA-2026:59593 · [email protected]https://access.redhat.com/security/cve/CVE-2026-73266 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2514217 · [email protected]
EPSS history
Timeline
  • 13 AUG 16:36Z
    Clusterclaims-controller: clusterclaims-controller: tenant-controlled clusterclaim labels propagated to managedcluster enabling cross-tenant managedclusterset join
    cvelistv5