CVE-2026-73269: Cluster-Curator-Controller Escalation

CVE-2026-73269 Overview

A privilege escalation flaw exists in the cluster-curator-controller component. A local user can create a ClusterCurator resource using a specific naming convention to trigger the creation of a cluster-scoped ClusterRoleBinding. This binding elevates the user from namespace-local access to full cluster-wide control.

Once elevated, the attacker can access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools. The flaw is tracked under CWE-269: Improper Privilege Management and affects multi-cluster management deployments that ship the vulnerable controller.

Critical Impact
An authenticated user with limited namespace access can escalate to cluster administrator, exposing all secrets and enabling destruction of hosted clusters.

Affected Products

Red Hat cluster-curator-controller component
Deployments consuming the vulnerable controller for cluster lifecycle management
Multi-cluster management platforms integrating cluster-curator-controller

Discovery Timeline

2026-08-12 - CVE-2026-73269 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73269

Vulnerability Analysis

The cluster-curator-controller reconciles ClusterCurator custom resources to automate cluster lifecycle operations. The controller programmatically creates supporting Kubernetes RBAC objects based on the name of the incoming ClusterCurator resource.

The controller does not validate that the resulting ClusterRoleBinding scope matches the requester's namespace-bound authority. An attacker who can create a ClusterCurator in a namespace they control can influence the binding's subject and role reference. The controller then creates a cluster-scoped ClusterRoleBinding on the attacker's behalf.

The resulting binding grants privileges far beyond the requester's original namespace permissions. This includes read and write access to all secrets, the ability to invoke cluster management actions, and destructive operations against hosted clusters and node pools.

Root Cause

The root cause is improper privilege management within the controller's reconciliation logic. The controller acts with elevated service account privileges and derives RBAC objects from user-controlled input without verifying that the requester holds equivalent cluster-wide rights. This confused-deputy pattern permits privilege escalation through a legitimate API call.

Attack Vector

Exploitation requires authenticated access to a namespace where the user can create ClusterCurator resources. The attacker submits a resource named according to the convention the controller recognizes for automatic ClusterRoleBinding creation. The controller processes the resource and creates the cluster-scoped binding, granting the attacker cluster-admin equivalent permissions. See the Red Hat CVE Advisory and the Red Hat Bug Report for further technical detail.

Detection Methods for CVE-2026-73269

Indicators of Compromise

Creation of ClusterRoleBinding objects owned or triggered by the cluster-curator-controller service account outside of expected provisioning workflows.
Unexpected ClusterCurator resources appearing in tenant or user-managed namespaces.
Audit log entries showing namespace-scoped users gaining access to cluster-scoped secrets shortly after ClusterCurator creation.

Detection Strategies

Enable Kubernetes API server audit logging at the RequestResponse level for clustercurators and clusterrolebindings resources.
Alert on create verbs against ClusterRoleBinding when the actor chain traces back to the cluster-curator-controller service account.
Correlate ClusterCurator creation events with subsequent Secret read operations from the same user identity.

Monitoring Recommendations

Ingest Kubernetes audit logs into a centralized analytics platform for continuous review of RBAC mutations.
Baseline the volume and namespaces of legitimate ClusterCurator activity, and alert on deviations.
Monitor deletion events against HostedCluster and NodePool resources for anomalous actors.

How to Mitigate CVE-2026-73269

Immediate Actions Required

Restrict create permissions on ClusterCurator resources to trusted administrative service accounts only.
Audit existing ClusterRoleBinding objects created by the cluster-curator-controller and remove any that were not intentionally provisioned.
Rotate secrets that may have been exposed to users with namespace access during the exposure window.

Patch Information

Consult the Red Hat CVE Advisory for the fixed component versions and product-specific errata. Apply vendor updates for the cluster-curator-controller and any dependent multi-cluster management products as soon as they are available.

Workarounds

Use Kubernetes admission controllers such as OPA Gatekeeper or Kyverno to block ClusterCurator resources whose names match the privileged convention.
Enforce namespace-scoped RBAC policies that prevent non-administrative users from creating ClusterCurator resources.
Temporarily disable the cluster-curator-controller in environments where cluster provisioning automation is not required.

bash

# Configuration example
# Restrict ClusterCurator creation to a specific admin group
kubectl create clusterrole clustercurator-admin \
  --verb=create,update,delete \
  --resource=clustercurators.cluster.open-cluster-management.io

kubectl create clusterrolebinding clustercurator-admin-binding \
  --clusterrole=clustercurator-admin \
  --group=cluster-admins