CVE-2026-73266

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Aug 13, 2026
Source updated: Sep 29, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

multicluster engine for Kubernetes 2.10

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.10
Platforms: Unknown
Default status: affected
Package: multicluster-engine/clusterclaims-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.10 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787196014	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.11

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.11
Platforms: Unknown
Default status: affected
Package: multicluster-engine/clusterclaims-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.11 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787239442	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.17

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.17
Platforms: Unknown
Default status: affected
Package: multicluster-engine/clusterclaims-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.17 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1786577950	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.6

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.6
Platforms: Unknown
Default status: affected
Package: multicluster-engine/clusterclaims-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.6 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787259112	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.8

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.8
Platforms: Unknown
Default status: affected
Package: multicluster-engine/clusterclaims-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787259059	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.9

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.9
Platforms: Unknown
Default status: affected
Package: multicluster-engine/clusterclaims-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787195995	`unaffected`	rpm	*	Unavailable	None listed