Bug 2514217 (CVE-2026-73266)

Summary:	CVE-2026-73266 clusterclaims-controller: Confused deputy: tenant-controlled ClusterClaim labels propagated to ManagedCluster, enabling cross-tenant ManagedClusterSet join
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-11 17:18:32 UTC

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). The createManagedCluster() function copies all tenant-controlled ClusterClaim labels onto the cluster-scoped ManagedCluster object without filtering, and setClusterSetLabel() preserves a tenant-supplied clusterset label. Combined with the controller's ClusterRole granting managedclustersets/join:create without resourceNames restrictions, a tenant can set a ClusterClaim label to join an arbitrary ManagedClusterSet belonging to another tenant. This confused deputy attack allows cross-tenant ManagedClusterSet join, potentially enabling policy and workload injection into victim clusters selected by Placement resources.

Upstream repo: https://github.com/stolostron/clusterclaims-controller
Audited commit: 89615dc8ce2de4aac192bf0289ab1a345947f28c
Jira tracker: ACM-38720