CVE-2026-73268: Multicluster Engine (MCE) RCE Vulnerability

CVE-2026-73268 Overview

CVE-2026-73268 is a code injection vulnerability [CWE-94] in the cluster-curator-controller component of the multicluster engine (MCE). A tenant holding create or update permissions on ClusterCurator resources can inject an arbitrary Job specification through the spec.install.overrideJob raw extension field. The CreateJob() function unmarshals this user-controlled input without validation, allowing the injected Job to execute with the controller's elevated privileges. Successful exploitation results in arbitrary code execution, privilege escalation, and potential access to cluster-wide secrets.

Critical Impact
A low-privileged tenant with ClusterCurator write access can escalate to cluster-admin equivalent privileges and read secrets across all namespaces.

Affected Products

Red Hat Advanced Cluster Management multicluster engine (MCE)
cluster-curator-controller component
Kubernetes clusters using MCE for cluster lifecycle management

Discovery Timeline

2026-08-12 - CVE-2026-73268 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73268

Vulnerability Analysis

The vulnerability resides in the CreateJob() function within the cluster-curator-controller. The controller processes ClusterCurator custom resources, which include an optional spec.install.overrideJob field defined as a runtime.RawExtension. This field is designed to allow customization of installation Jobs, but the controller unmarshals its contents directly into a Kubernetes batchv1.Job object without applying schema validation, admission checks, or field-level restrictions.

Because the controller runs with a service account bound to broad cluster-scoped permissions, any Job it creates inherits those privileges. An attacker with permission to create or update ClusterCurator resources in a single namespace can craft a Job spec that mounts sensitive secrets, executes arbitrary container images, or launches pods with privileged security contexts.

Root Cause

The root cause is missing input validation on a user-supplied raw extension field. The CreateJob() function trusts the deserialized overrideJob payload and passes it directly to the Kubernetes API. There is no allowlist for container images, no restriction on volume mounts, and no enforcement that the Job operate within the tenant's own privilege boundary.

Attack Vector

An authenticated tenant with write access to ClusterCurator resources submits a manifest containing a malicious spec.install.overrideJob payload. The controller reads the resource, deserializes the override, and creates a Job in the cluster. The Job runs under the controller's service account context, granting the attacker's container access to resources the tenant could not otherwise reach, including secrets in other namespaces and cluster-wide APIs. Refer to the Red Hat CVE-2026-73268 advisory and the Red Hat Bug Report #2514219 for vendor technical details.

Detection Methods for CVE-2026-73268

Indicators of Compromise

Creation or modification of ClusterCurator resources containing a populated spec.install.overrideJob field.
Jobs created by the cluster-curator-controller service account that reference unexpected container images or registries.
Pods spawned by curator-created Jobs mounting ServiceAccount tokens or secrets outside the requesting tenant's namespace.
Unusual API access patterns from the cluster-curator-controller service account, including reads of cluster-wide secrets.

Detection Strategies

Audit the Kubernetes API server logs for create and update verbs on clustercurators.cluster.open-cluster-management.io resources and inspect the diff for overrideJob content.
Correlate Job creation events with their originating ClusterCurator object owner references to identify tenant-driven privilege escalation attempts.
Alert on Jobs created by the controller that specify privileged: true, hostPID, hostNetwork, or host path mounts.

Monitoring Recommendations

Enable Kubernetes audit logging at the RequestResponse level for ClusterCurator resources.
Stream cluster audit and workload telemetry into a centralized data lake for retention and correlation across managed clusters.
Continuously monitor service account token usage for the cluster-curator-controller and flag deviations from baseline behavior.

How to Mitigate CVE-2026-73268

Immediate Actions Required

Restrict RBAC permissions on ClusterCurator resources to trusted cluster administrators only, removing tenant create and update verbs.
Deploy an admission controller policy (OPA Gatekeeper, Kyverno, or Validating Admission Policy) that rejects ClusterCurator resources containing an overrideJob field until a patch is applied.
Rotate any secrets accessible to the cluster-curator-controller service account if exploitation is suspected.

Patch Information

Monitor the Red Hat CVE-2026-73268 advisory for the fixed MCE release. Upgrade the multicluster engine operator to the patched version as soon as it is available and verify that the CreateJob() function validates the overrideJob input.

Workarounds

Apply a Kyverno or Gatekeeper policy that blocks ClusterCurator submissions containing a non-empty spec.install.overrideJob.
Scope the cluster-curator-controller service account with the least privilege required, removing cluster-wide secret read permissions where feasible.
Isolate MCE-managed workloads into dedicated namespaces with network policies limiting east-west traffic from curator-created Jobs.

bash

# Example Kyverno ClusterPolicy to block overrideJob until patched
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-clustercurator-overridejob
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-overridejob
      match:
        any:
          - resources:
              kinds:
                - cluster.open-cluster-management.io/v1beta1/ClusterCurator
      validate:
        message: "spec.install.overrideJob is disallowed (CVE-2026-73268)."
        pattern:
          spec:
            install:
              X(overrideJob): "null"