boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-73266

CVE-2026-73266HIGH
Red Hat multicluster engine for Kubernetes 2.10 — Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  C  H  L  N    7.1   .0035   26.5     —
AFFECTED
  Product                                  Versions     Fixed
  multicluster engine for Kubernetes 2.10  unspecified  1787196014
  multicluster engine for Kubernetes 2.11  unspecified  1787239442
  multicluster engine for Kubernetes 2.17  unspecified  1786577950
  multicluster engine for Kubernetes 2.6   unspecified  1787259112
  multicluster engine for Kubernetes 2.8   unspecified  1787259059
  multicluster engine for Kubernetes 2.9   unspecified  1787195995
TIMELINE
  Aug 11  Reserved by redhat
  Aug 13  Published (CNA: redhat)
  Aug 25  PATCH SHIPPED — CVE-2026-73266 (Red Hat multicluster engine for Kubernetes 2.10). Fixed in multicluster engine for Kubernetes 2.10 1787196014.
CWE-441 · CNA: redhat · CVSS v3.1 · 8 references · NVD status: Awaiting Analysis

Description

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
August 11, 2026ReservedReserved by redhat
August 13, 2026PublishedPublished (CNA: redhat)
August 25, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-73266 (Red Hat multicluster engine for Kubernetes 2.10). Fixed in multicluster engine for Kubernetes 2.10 1787196014.

Affected

Affected products and packages — 6 rows
VendorProduct / PackageEcosystemVersion introducedFixed
Red Hatmulticluster engine for Kubernetes 2.10——1787196014
Red Hatmulticluster engine for Kubernetes 2.11——1787239442
Red Hatmulticluster engine for Kubernetes 2.17——1786577950
Red Hatmulticluster engine for Kubernetes 2.6——1787259112
Red Hatmulticluster engine for Kubernetes 2.8——1787259059
Red Hatmulticluster engine for Kubernetes 2.9——1787195995

Weaknesses

CWE-441

References (8)

Related

Authoritative record: CVE-2026-73266 at cve.org

Vendors: red hat

Weaknesses: CWE-441

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-73266 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.