Bug 2514219 (CVE-2026-73268) - CVE-2026-73268 cluster-curator-controller: cluster-curator-controller: spec.install.overrideJob allows arbitrary Job spec injection
Summary: CVE-2026-73268 cluster-curator-controller: cluster-curator-controller: spec.i...
Keywords:
Status: NEW
Alias: CVE-2026-73268
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-11 17:18 UTC by OSIDB Bzimport
Modified: 2026-08-12 17:44 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-11 17:18:40 UTC 
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). The CreateJob() function unmarshals the user-controlled spec.install.overrideJob raw extension into a batchv1.Job and creates it using the controller's privileged ServiceAccount without validating the image, command, serviceAccountName, hostNetwork, or volumes fields. The CRD field uses PreserveUnknownFields RawExtension with no CEL or webhook validation. A tenant with create/update permissions on ClusterCurator resources can inject an arbitrary Job specification that runs with the controller's elevated privileges, including the cluster-installer ServiceAccount that holds cluster-wide secrets and managed cluster access.

Upstream repo: https://github.com/stolostron/cluster-curator-controller
Audited commit: 0e050d6e5edf5d2fbc2794fa468bdffd056b444f
Jira tracker: ACM-38728
Note You need to log in before you can comment on or make changes to this bug.