CVE-2026-73266

HIGH

CVE: CVE-2026-73266 - A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE)Sign in to save

CVSS

7.1

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 13, 2026

Exploitability

No EPSS data available

Description

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

Weaknesses

CWE-441

Affected Packages

No package data available.

Aliases

CVE-2026-73266

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://access.redhat.com/security/cve/CVE-2026-73266
https://bugzilla.redhat.com/show_bug.cgi?id=2514217