Local Privilege Escalation in cluster-curator-controller via ClusterCurator Resources

The cluster-curator-controller component contains a critical vulnerability (CVE-2026-73269) that enables local privilege escalation within Kubernetes-based environments. An attacker with existing namespace-local access can exploit this flaw by submitting a ClusterCurator resource object configured with a specific naming convention. The controller incorrectly processes this resource, resulting in the unauthorized creation of a cluster-scoped ClusterRoleBinding. This misconfiguration grants the attacker excessive permissions across the entire cluster, effectively elevating their access from a limited namespace scope to full administrative control. Impacted organizations are at risk of unauthorized access to sensitive secrets, modification of cluster configurations, and the potential destruction of hosted clusters or node pools. Because the exploit relies on the creation of legitimate K8s objects, defenders must focus on monitoring for anomalous resource naming patterns and unauthorized ClusterRoleBinding creation.

Attack Chain

1. Attacker establishes initial access to the cluster within a restricted namespace.
2. Attacker identifies the cluster-curator-controller presence within the environment.
3. Attacker crafts a malicious ClusterCurator resource object with a target-specific naming convention.
4. Attacker applies the resource to their local namespace via kubectl apply or Kubernetes API calls.
5. The cluster-curator-controller observes the new resource and attempts to process its configuration.
6. Controller logic fails to validate the resource name, causing it to escalate permissions.
7. Controller creates a ClusterRoleBinding with cluster-scoped administrative privileges.
8. Attacker leverages the resulting ClusterRoleBinding to exfiltrate secrets or delete node pools.

Impact

Successful exploitation leads to full cluster-wide privilege escalation. Attackers can access and exfiltrate highly sensitive secrets, manipulate critical cluster resources, or delete hosted clusters and node pools, potentially causing complete infrastructure compromise and widespread service disruption.

Recommendation

• Monitor Kubernetes audit logs for the creation of ClusterRoleBinding resources.
• Audit existing ClusterCurator resources for anomalous naming conventions that deviate from documented naming standards.
• Implement admission control policies to restrict the ability of low-privileged users to create or modify ClusterCurator resources.
• Review the cluster-curator-controller logs for unexpected resource handling errors related to CVE-2026-73269.