{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10059", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-05-29T08:14:22.495Z", "datePublished": "2026-08-05T08:54:51.726Z", "dateUpdated": "2026-08-05T14:26:49.274Z"}, "containers": {"cna": {"title": "Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster."}], "affected": [{"vendor": "Red Hat", "product": "Multicluster Engine for Kubernetes", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "multicluster-engine/cluster-curator-controller-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:multicluster_engine"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10059", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483187", "name": "RHBZ#2483187", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-05T08:35:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-266: Incorrect Privilege Assignment", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-05-06T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-05T08:35:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-08-05T08:54:51.726Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T14:21:58.044319Z", "id": "CVE-2026-10059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T14:26:49.274Z"}}]}}

{}

{}

{"acknowledgement": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue.", "bugzilla": {"description": "cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via ClusterCurator ServiceAccount token", "id": "2483187", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483187"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-10059", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/cluster-curator-controller-rhel9", "product_name": "Multicluster Engine for Kubernetes"}], "public_date": "2026-08-05T08:35:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-10059\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-10059"], "statement": "This is an Important privilege escalation flaw in Multicluster Engine for Kubernetes. A namespace-scoped tenant administrator can achieve cluster-wide administrative authority by leveraging the ClusterCurator controller's creation of cluster-scoped RBAC for a ServiceAccount within a tenant-controlled namespace. This allows the tenant to mint a token for the controller-created ServiceAccount, granting full control over the cluster.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Multicluster Engine for Kubernetes", "source": "cna", "vendor": "Red Hat"}, "product": "multicluster_engine_for_kubernetes", "vendor": "redhat"}], "created": "2026-08-05T11:00:11.329160+00:00", "updated": "2026-08-05T11:00:12.089930+00:00", "vendors": ["redhat", "redhat$PRODUCT$multicluster_engine_for_kubernetes"]}