Bug 2483187 (CVE-2026-10059)

Summary:	CVE-2026-10059 cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via ClusterCurator ServiceAccount token
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alcohan, gparvin, jbalunas, pahickey, rhaigner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-08-05

Description OSIDB Bzimport 2026-05-29 09:54:31 UTC

A namespace-scoped tenant admin in an ordinary hub namespace can create a namespaced `ClusterCurator`. The ClusterCurator controller responds by creating a `cluster-installer` ServiceAccount in that tenant namespace and cluster-scoped RBAC that binds `ClusterRole/curator` to that ServiceAccount through `ClusterRoleBinding/curator-crb`.

Because the same tenant namespace admin can create `serviceaccounts/token` for ServiceAccounts in its namespace, the tenant can mint a token for the controller-created `cluster-installer` ServiceAccount and directly act with cluster-wide curator authority.

This is not merely "a tenant can create a lifecycle object." The vulnerable behavior is that the controller materializes cluster-wide RBAC onto a predictable ServiceAccount in a tenant-controlled namespace, and that ServiceAccount token is tenant-mintable.