CVE-2026-73267: Multicluster Engine ClusterClaim DoS Flaw

CVE-2026-73267 Overview

A flaw in the clusterclaims-controller component of Red Hat's multicluster engine (MCE) allows a tenant with standard ClusterClaim permissions to delete arbitrary ManagedCluster resources. The controller fails to verify ownership of the target namespace referenced in the spec.namespace field. An authenticated tenant can manipulate this field to target the hub's local-cluster or clusters belonging to other tenants. Successful exploitation results in denial of service across the multicluster fleet. The issue is tracked under CWE-602: Client-Side Enforcement of Server-Side Security.

Critical Impact
A low-privileged tenant can delete any ManagedCluster in the hub, including the local-cluster, causing service-wide disruption of managed Kubernetes fleets.

Affected Products

Red Hat Advanced Cluster Management for Kubernetes (RHACM)
Red Hat multicluster engine for Kubernetes (MCE)
Deployments using the clusterclaims-controller component

Discovery Timeline

2026-08-21 - CVE-2026-73267 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-73267

Vulnerability Analysis

The multicluster engine (MCE) uses ClusterClaim resources to let tenants request and release managed Kubernetes clusters from a pool. The clusterclaims-controller reconciles these requests and issues delete operations against the ManagedCluster API on behalf of the claim owner. The controller trusts the spec.namespace field of a ClusterClaim without validating that the requesting tenant owns or has rights over the referenced namespace or cluster. A tenant holding only the baseline create and delete verbs on ClusterClaim objects in their own namespace can therefore direct the controller to delete a ManagedCluster outside their tenancy boundary. This is an authorization gap in a privileged control-plane component acting on the tenant's behalf. Deleting the hub's local-cluster object severs the hub's self-management binding and disrupts fleet-wide operations including policy propagation, application placement, and observability.

Root Cause

The root cause is a missing ownership check between the ClusterClaim submitter and the ManagedCluster referenced by spec.namespace. The controller enforces access on the client-side claim object rather than on the downstream cluster resource it manipulates, matching the [CWE-602] pattern where server-side authorization on the effective action is absent.

Attack Vector

Exploitation requires network access to the Kubernetes API server and a service account or user with permissions to create ClusterClaim resources in any tenant namespace. The attacker submits a crafted ClusterClaim whose spec.namespace points at a ManagedCluster they do not own, such as local-cluster, then deletes the claim to trigger the controller's cleanup path. No user interaction is required, and the attack completes with a single API call sequence. See the Red Hat CVE record and Red Hat Bugzilla #2514218 for advisory details.

Detection Methods for CVE-2026-73267

Indicators of Compromise

Unexpected ManagedCluster deletion events in the Kubernetes audit log, particularly targeting local-cluster or clusters outside the requesting tenant's namespace.
ClusterClaim create/delete sequences where spec.namespace references a cluster the submitter does not own.
Sudden loss of hub self-management, policy propagation failures, or ManagedClusterUnavailable conditions across the fleet.

Detection Strategies

Audit Kubernetes API server logs for delete verbs on managedclusters.cluster.open-cluster-management.io originating from the clusterclaims-controller service account, and correlate with the initiating ClusterClaim submitter.
Alert when a ClusterClaim is created whose spec.namespace value does not match a cluster in the claim owner's authorized pool.
Baseline the normal rate of ManagedCluster deletions and flag statistical outliers.

Monitoring Recommendations

Ship Kubernetes audit logs and MCE controller logs to a centralized analytics platform for retention and correlation.
Monitor RBAC bindings that grant clusterclaims.cluster.open-cluster-management.io verbs and review any new bindings.
Track health of local-cluster and pinned production ManagedCluster objects with synthetic checks that alert on deletion or NotFound responses.

How to Mitigate CVE-2026-73267

Immediate Actions Required

Apply the Red Hat security updates referenced in RHSA-2026:59556, RHSA-2026:59557, RHSA-2026:59558, RHSA-2026:59559, RHSA-2026:59579, and RHSA-2026:59593.
Inventory all principals with create or delete permissions on ClusterClaim resources and remove non-essential grants.
Review recent Kubernetes audit logs for unauthorized ManagedCluster deletions and restore any affected clusters from backup.

Patch Information

Red Hat has issued patched builds of multicluster engine and Advanced Cluster Management. Consult the Red Hat CVE page for CVE-2026-73267 for the full list of fixed versions and channel mappings, and apply the errata that corresponds to your deployed MCE or RHACM release.

Workarounds

Restrict ClusterClaim RBAC to trusted service accounts and tenant namespaces until the patch is applied.
Use a validating admission policy or ValidatingAdmissionPolicy to reject ClusterClaim resources whose spec.namespace targets local-cluster or namespaces outside the submitter's scope.
Protect critical ManagedCluster objects with a finalizer or admission webhook that blocks deletion by the clusterclaims-controller service account for out-of-scope clusters.

bash

# Example: audit who can create ClusterClaims in the cluster
kubectl get rolebindings,clusterrolebindings -A -o json | \
  jq '.items[] | select(.roleRef.name | test("clusterclaim"; "i")) | {kind, name: .metadata.name, subjects}'

# Example: list recent ManagedCluster deletion events from the audit log
grep '"verb":"delete"' /var/log/kube-apiserver/audit.log | \
  grep 'managedclusters.cluster.open-cluster-management.io'