CVE-2026-73266 HIGH

CVE-2026-73266: Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

Weakness CWE-441

Published August 13, 2026

Last update September 8, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

Key dates

02Disclosure timeline

August 13, 2026 CVE published

September 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-73266 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/441.html AskarLabs — CWE-441 write-up Unintended Proxy or Intermediary ('Confused Deputy')