中文

// CVE · PUBLISHED 2026-08-05

CVE-2026-10059

Red Hat / multicluster engine for Kubernetes 2.1 · Red Hat / multicluster engine for Kubernetes 2.11 · Red Hat / multicluster engine for Kubernetes 2.6 · +2

9.1 · CVSS 3.1Critical

Description

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

References

Related CVEs

  • CVE-2026-72508Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 · +5CVSS 9.9
  • CVE-2026-72526Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 · +5CVSS 9.9
  • CVE-2026-70398Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 · +5CVSS 9.6
  • CVE-2026-71231thebradleysanders / IOTSmartHomeCVSS 9.8
  • CVE-2026-44945SUSE / RancherCVSS 9.1
  • CVE-2026-10090Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 · +5CVSS 9.0
  • CVE-2026-71214NASA-AMMOS / plandev (sequencing-server)CVSS 9.8
  • CVE-2026-71207mrswapnilsahu / Stock-Inventory-Management-SystemCVSS 9.8

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.