CVE-2026-10059

Name of the Vulnerable Software and Affected Versions Multicluster Engine for Kubernetes (affected versions not specified)

Description A flaw in the ClusterCurator controller allows a tenant administrator with namespace-scoped privileges to escalate their privileges. By creating a namespaced ClusterCurator, the administrator can inadvertently mint a token for a ServiceAccount that possesses cluster-wide administrative authority, potentially granting them full control over the cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.