Bug 2514220 (CVE-2026-73269)

Summary:	CVE-2026-73269 cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates ClusterRoleBinding granting cluster-wide secrets access to namespace-local SA
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-11 17:18:43 UTC

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). When a ClusterCurator resource is created with metadata.name different from metadata.namespace, the ApplyRBACHypershift function creates a RoleBinding in an arbitrary namespace (specified by curator.Name) and a cluster-scoped ClusterRoleBinding (curator-crb), both binding the tenant's namespace-local cluster-installer ServiceAccount to the curator ClusterRole. This ClusterRole grants cluster-wide secrets:get/create, managedclusteractions:*, and hostedclusters/nodepools/managedclusters delete permissions. A tenant can escalate from namespace-local access to cluster-wide privileges with no admission controls.

Upstream repo: https://github.com/stolostron/cluster-curator-controller
Audited commit: 0e050d6e5edf5d2fbc2794fa468bdffd056b444f
Jira tracker: ACM-38729