CVE-2026-73267

Name of the Vulnerable Software and Affected Versions multicluster engine (affected versions not specified)

Description A flaw in the clusterclaims-controller component allows a tenant with standard permissions to create and delete ClusterClaim resources to cause a denial of service. By manipulating the spec.namespace field, a tenant can delete any ManagedCluster, including the hub's local-cluster or clusters belonging to other tenants, because the system fails to perform an ownership check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.