CVE-2026-10059 Red Hat CVE debrief

Who should care

Tenant administrators, Kubernetes cluster administrators, and security teams responsible for managing and securing Kubernetes deployments should be aware of this vulnerability and take necessary actions to mitigate it.

Why it matters

CVE-2026-10059 is a critical vulnerability in the Multicluster Engine for Kubernetes that allows tenant administrators to escalate privileges, potentially leading to unauthorized access and lateral movement within the cluster. Defenders should prioritize verifying and mitigating this vulnerability, especially those managing Kubernetes clusters and tenant administrator access.

• Potential privilege escalation for tenant administrators.
• Increased risk of unauthorized access to Kubernetes clusters.
• Possible lateral movement within the cluster.
• Need for verification of affected versions and remediation.

Technical summary

The Multicluster Engine for Kubernetes ClusterCurator controller is vulnerable to a privilege escalation attack. A tenant administrator with namespace-scoped privileges can create a namespaced ClusterCurator, which grants the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This vulnerability can be exploited by creating a namespaced ClusterCurator, allowing the tenant administrator to gain elevated privileges and potentially leading to unauthorized access and lateral movement within the cluster.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially those managing Kubernetes clusters and tenant administrator access.

Recommended defensive actions

• Verify and apply Red Hat's provided errata and security advisories for this CVE.
• Restrict namespace-scoped privileges for tenant administrators.
• Monitor and audit ClusterCurator controller activities.
• Implement compensating controls to limit the impact of potential privilege escalation.
• Review and update access control configurations for Kubernetes deployments.
• Conduct regular security audits to detect and address potential vulnerabilities.
• Track and verify the application of patches and mitigations for affected systems.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score and vector. Red Hat has provided errata and a security advisory for this CVE. The vulnerability affects the Multicluster Engine for Kubernetes ClusterCurator controller, and defenders should verify affected versions and apply necessary patches or mitigations. The NVD entry is currently Awaiting Analysis, and additional information may be available from Red Hat's errata and security advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.