Bug 2514219 (CVE-2026-73268)

Summary:	CVE-2026-73268 cluster-curator-controller: cluster-curator-controller: spec.install.overrideJob allows arbitrary Job spec injection
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-11 17:18:40 UTC

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). The CreateJob() function unmarshals the user-controlled spec.install.overrideJob raw extension into a batchv1.Job and creates it using the controller's privileged ServiceAccount without validating the image, command, serviceAccountName, hostNetwork, or volumes fields. The CRD field uses PreserveUnknownFields RawExtension with no CEL or webhook validation. A tenant with create/update permissions on ClusterCurator resources can inject an arbitrary Job specification that runs with the controller's elevated privileges, including the cluster-installer ServiceAccount that holds cluster-wide secrets and managed cluster access.

Upstream repo: https://github.com/stolostron/cluster-curator-controller
Audited commit: 0e050d6e5edf5d2fbc2794fa468bdffd056b444f
Jira tracker: ACM-38728