{"id":"CVE-2026-73266","aliases":["EUVD-2026-58132","GHSA-xp42-v53j-r9gh"],"status":"published","title":"Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join","description":"A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00352,"percentile":0.29099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-441"],"published":"2026-08-13T16:36:45Z","modified":"2026-09-29T20:17:23Z","products":[{"vendor":"red hat","product":"multicluster engine for kubernetes 2.10"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.11"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.17"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.6"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:59556","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59557","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59558","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59559","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59579","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59593","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73266","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514217","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73266"},{"url":"https://github.com/advisories/GHSA-xp42-v53j-r9gh"}],"sources":{"cve":[{"id":"CVE-2026-73266","title":"Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join","description":"A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.","status":"published","published":"2026-08-13T16:36:45.097Z","modified":"2026-09-29T19:41:29.817Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-441"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-58132","description":"A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.","status":"published","published":"2026-08-13T16:36:45Z","modified":"2026-09-29T19:41:29Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:51.078545Z"}],"ghsa":[{"id":"GHSA-xp42-v53j-r9gh","title":"A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An...","description":"A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.","status":"published","published":"2026-08-13T18:31:41Z","modified":"2026-09-05T15:30:26Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-441"],"updated_at":"2026-11-02T15:11:24.999449Z"}],"nvd":[{"id":"CVE-2026-73266","description":"A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.","status":"published","published":"2026-08-13T17:17:35.713Z","modified":"2026-09-29T20:17:23.253Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-441"],"updated_at":"2026-11-02T14:12:37.557758Z"}]}}