THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-73268 (CRITICAL 9.9) — A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-co

[NVD] CVE-2026-73268 (CRITICAL 9.9) — A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-co

mednvdPublished 2026-08-12

CVE-2026-73268 CVSS: 9.9 CRITICAL Published: 2026-08-12T20:17:53.650

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.

Indicators of compromise

CVE-2026-73268cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73268