CVE-2026-73267 Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267

In Red Hat's multicluster engine, the clusterclaims-controller deletes ManagedClusters based solely on clusterclaim.spec.namespace without verifying ownership. Any tenant with standard ClusterClaim permissions can delete any cluster, including the hub's local-cluster, causing a HIGH-severity (7.7...

PT-2026-79290

Name of the Vulnerable Software and Affected Versions multicluster engine affected versions not specified Description A flaw in the clusterclaims-controller component allows a tenant with standard permissions to create and delete ClusterClaim resources to cause a denial of service. By manipulatin...