Authorization Flaw in Red Hat Multicluster Engine Clusterclaims-controller

The clusterclaims-controller component within the Red Hat multicluster engine (MCE) contains an authorization bypass vulnerability identified as CVE-2026-73267. The flaw exists because the controller fails to perform adequate ownership verification when processing ClusterClaim resources. A tenant with standard permissions to create and delete ClusterClaim objects can maliciously manipulate the spec.namespace field within these resources. By specifying arbitrary namespaces, an attacker can coerce the controller into deleting ManagedCluster resources that they do not own, including those managed by the hub or belonging to other tenants. This vulnerability effectively allows for unauthorized resource destruction, leading to a significant denial-of-service condition within the affected multicluster environment. Defenders should prioritize patching this controller to enforce strict ownership validation for ClusterClaim operations.

Impact

The vulnerability poses a high risk to multicluster environments, enabling a malicious or compromised tenant to perform unauthorized deletions of ManagedCluster resources. Successful exploitation results in a persistent denial-of-service, disrupting cluster management workflows and potential cross-tenant isolation failure. Impact is focused on users of Red Hat multicluster engine deployments.

Recommendation

• Identify all instances of Red Hat multicluster engine (MCE) within the infrastructure and verify patch availability from the vendor for CVE-2026-73267.
• Review RBAC policies for users with 'create' or 'delete' permissions on ClusterClaim resources to limit the scope of potential abuse during the remediation phase.
• Monitor Kubernetes API audit logs for unusual deletion events targeted at ManagedCluster resources initiated by non-administrative service accounts or tenant-associated users.