Vulnerability-Lookup

CVE-2026-73267 (GCVE-0-2026-73267)

Vulnerability from cvelistv5 – Published: 2026-08-21 02:43 – Updated: 2026-09-08 12:15

Title

Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

Summary

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:34 UTC

CWE

CWE-602 - Client-Side Enforcement of Server-Side Security

Assigner

redhat redhat root

References

8 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:59556	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59557	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59558	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59559	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59579	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59593	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-73267	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2514218	issue-trackingx_refsource_REDHAT

Impacted products

6 products

Vendor	Product	Version
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1787196014 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1787239442 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.17	Unaffected: 1786577950 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.17::el9
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1787259112 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1787259059 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1787195995 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9

Date Public

2026-08-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73267",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:34:54.106824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:35:07.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.10::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.1",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787196014",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.11::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.11",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787239442",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786577950",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787259112",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787259059",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.9::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787195995",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub\u0027s local-cluster or other tenants\u0027 clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-602",
              "description": "Client-Side Enforcement of Server-Side Security",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T12:15:28.868Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:59556",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:59556"
        },
        {
          "name": "RHSA-2026:59557",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:59557"
        },
        {
          "name": "RHSA-2026:59558",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:59558"
        },
        {
          "name": "RHSA-2026:59559",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:59559"
        },
        {
          "name": "RHSA-2026:59579",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:59579"
        },
        {
          "name": "RHSA-2026:59593",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:59593"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-73267"
        },
        {
          "name": "RHBZ#2514218",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514218"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-10T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-11T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-602: Client-Side Enforcement of Server-Side Security"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-73267",
    "datePublished": "2026-08-21T02:43:36.017Z",
    "dateReserved": "2026-08-11T17:22:38.645Z",
    "dateUpdated": "2026-09-08T12:15:28.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73267",
      "date": "2026-09-14",
      "epss": "0.00462",
      "percentile": "0.38824"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73267\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-08-21T03:16:39.080\",\"lastModified\":\"2026-09-08T13:17:22.080\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub\u0027s local-cluster or other tenants\u0027 clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/clusterclaims-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.10::el9\"],\"versions\":[{\"version\":\"1787196014\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.11\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/clusterclaims-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.11::el9\"],\"versions\":[{\"version\":\"1787239442\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/clusterclaims-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.17::el9\"],\"versions\":[{\"version\":\"1786577950\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/clusterclaims-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.6::el9\"],\"versions\":[{\"version\":\"1787259112\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/clusterclaims-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.8::el9\"],\"versions\":[{\"version\":\"1787259059\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/clusterclaims-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.9::el9\"],\"versions\":[{\"version\":\"1787195995\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-25T15:34:54.106824Z\",\"id\":\"CVE-2026-73267\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-602\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:59556\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:59557\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:59558\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:59559\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:59579\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:59593\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-73267\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2514218\",\"source\":\"secalert@redhat.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-08T12:15:17+00:00",
      "cve": "CVE-2026-73267",
      "id": "CVE-2026-73267",
      "initial_release_date": "2026-08-11T00:00:00+00:00",
      "product_status:fixed": "24",
      "product_status:known_not_affected": "704",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "clusterclaims-controller: ManagedCluster deletion keyed solely on ClusterClaim.Spec.Namespace with no local ownership check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73267.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73267\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T15:34:54.106824Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T15:35:00.566Z\"}}], \"cna\": {\"title\": \"Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.10::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787196014\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/clusterclaims-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.11\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787239442\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/clusterclaims-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786577950\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/clusterclaims-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787259112\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/clusterclaims-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787259059\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/clusterclaims-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.9.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787195995\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/clusterclaims-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-10T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-08-11T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-08-11T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:59556\", \"name\": \"RHSA-2026:59556\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:59557\", \"name\": \"RHSA-2026:59557\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:59558\", \"name\": \"RHSA-2026:59558\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:59559\", \"name\": \"RHSA-2026:59559\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:59579\", \"name\": \"RHSA-2026:59579\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:59593\", \"name\": \"RHSA-2026:59593\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-73267\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2514218\", \"name\": \"RHBZ#2514218\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub\u0027s local-cluster or other tenants\u0027 clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-602\", \"description\": \"Client-Side Enforcement of Server-Side Security\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-09-07T18:34:46.598Z\"}, \"x_redhatCweChain\": \"CWE-602: Client-Side Enforcement of Server-Side Security\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73267\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-07T18:34:46.598Z\", \"dateReserved\": \"2026-08-11T17:22:38.645Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-08-21T02:43:36.017Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73267

Vulnerability from fkie_nvd - Published: 2026-08-21 03:16 - Updated: 2026-09-08 13:17

Severity

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:59556
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:59557
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:59558
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:59559
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:59579
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:59593
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2026-73267
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2514218

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.10::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.1",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787196014",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.11::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.11",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787239442",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786577950",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787259112",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787259059",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine:2.9::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/clusterclaims-controller-rhel9",
          "product": "multicluster engine for Kubernetes 2.9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787195995",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub\u0027s local-cluster or other tenants\u0027 clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters."
    }
  ],
  "id": "CVE-2026-73267",
  "lastModified": "2026-09-08T13:17:22.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73267",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T15:34:54.106824Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T03:16:39.080",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:59556"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:59557"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:59558"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:59559"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:59579"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:59593"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2026-73267"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514218"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-602"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-Q3CG-8R2R-6G4G

Vulnerability from github – Published: 2026-08-21 03:31 – Updated: 2026-08-28 21:30

Details

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.

Severity

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-73267"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-602"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-21T03:16:39Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub\u0027s local-cluster or other tenants\u0027 clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.",
  "id": "GHSA-q3cg-8r2r-6g4g",
  "modified": "2026-08-28T21:30:45Z",
  "published": "2026-08-21T03:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73267"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:59556"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:59557"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:59558"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:59559"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:59579"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:59593"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-73267"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514218"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

RHSA-2026:59556

Vulnerability from csaf_redhat - Published: 2026-08-25 18:37 - Updated: 2026-09-14 05:27

Summary

Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.6 security update

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2026-73267.

CVE-2026-73267

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Fixed: 4 products Known not affected: 124 products

https://access.redhat.com/errata/RHSA-2026:59556

Open the full advisory

RHSA-2026:59557

Vulnerability from csaf_redhat - Published: 2026-08-25 18:46 - Updated: 2026-09-14 05:27

Summary

Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.6 security update

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2026-73267.

CVE-2026-73267

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Fixed: 4 products Known not affected: 120 products

https://access.redhat.com/errata/RHSA-2026:59557

Open the full advisory

RHSA-2026:59558

Vulnerability from csaf_redhat - Published: 2026-08-25 18:48 - Updated: 2026-09-14 20:47

Summary

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.10 security update

Severity

Important

Scope

30 vulnerabilities in this advisory, including CVE-2026-73267.

CVE-2026-73267

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Fixed: 4 products Known not affected: 104 products

https://access.redhat.com/errata/RHSA-2026:59558

Open the full advisory

RHSA-2026:59559

Vulnerability from csaf_redhat - Published: 2026-08-25 18:50 - Updated: 2026-09-14 20:47

Summary

Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.7 security update

Severity

Important

Scope

31 vulnerabilities in this advisory, including CVE-2026-73267.

CVE-2026-73267

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Fixed: 4 products Known not affected: 116 products

https://access.redhat.com/errata/RHSA-2026:59559

Open the full advisory

RHSA-2026:59579

Vulnerability from csaf_redhat - Published: 2026-08-25 19:37 - Updated: 2026-09-14 20:47

Summary

Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.14 security update

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2026-73267.

CVE-2026-73267

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Fixed: 4 products Known not affected: 104 products

https://access.redhat.com/errata/RHSA-2026:59579

Open the full advisory

RHSA-2026:59593

Vulnerability from csaf_redhat - Published: 2026-08-25 19:56 - Updated: 2026-09-14 20:47

Summary

Red Hat Security Advisory: multicluster engine for Kubernetes v2.17.2 security update

Severity

Important

Scope

25 vulnerabilities in this advisory, including CVE-2026-73267.

CVE-2026-73267

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Fixed: 4 products Known not affected: 136 products

https://access.redhat.com/errata/RHSA-2026:59593

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73267 (GCVE-0-2026-73267)

Tags

Sightings

Nomenclature