CVE-2026-73269

Name of the Vulnerable Software and Affected Versions cluster-curator-controller (affected versions not specified)

Description A flaw in the cluster-curator-controller component allows a local user to escalate privileges from namespace-local access to cluster-wide control. By creating a ClusterCurator resource using a specific naming convention, an attacker can trigger the creation of a cluster-scoped ClusterRoleBinding. This results in broad permissions, enabling the user to manage cluster actions, access and manipulate secrets, and delete node pools or hosted clusters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.