Bug 2514218 (CVE-2026-73267)

Summary:	CVE-2026-73267 clusterclaims-controller: clusterclaims-controller: ManagedCluster deletion keyed solely on ClusterClaim.Spec.Namespace with no ownership check
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-11 17:18:36 UTC

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). The controller's deleteResources() function uses the tenant-controlled ClusterClaim.Spec.Namespace field to identify the target ManagedCluster for deletion without any ownership or owner-reference check. A tenant with standard create and delete permissions on ClusterClaim resources can set spec.namespace to the name of any ManagedCluster (including the hub's local-cluster or other tenants' clusters), and upon deleting the ClusterClaim, the controller deletes the targeted ManagedCluster. No admission webhook or CRD CEL validation constrains the spec.namespace field.

Upstream repo: https://github.com/stolostron/clusterclaims-controller
Audited commit: 89615dc8ce2de4aac192bf0289ab1a345947f28c
Jira tracker: ACM-38721