CVE-2026-73267General

LOWCVSS 7.7 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-602

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
General: 2 classified signals
Disclosure: 1 classified signal
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

General

266.7%

Disclosure

133.3%

Referenced assets3 URLs

By indicator

Full discourse3 posts

CVE@CVEnew46d
Disclosure
CVE-2026-73267 A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resource… https://www.cve.org/CVERecord?id=CVE-2026-73267
Post summary
The post discloses a flaw in the clusterclaims-controller of Multicluster Engine (CVE-2026-73267), noting that a tenant with standard permissions can create and delete ClusterClaim resources. No PoC, exploit code, or patch is referenced.
00000723
58.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds46d
General
CVE-2026-73267 Unauthorized ManagedCluster Deletion in Multicluster Engine (MCE) Clusterclaims-Controller https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73267
Post summary
The text lists a CVE identifier and a general description with a link, but provides no specific details, exploit code, or patch information.
0000089
4.1K followersView on X
SecNews@SecNews_GR46d
General
Multicluster Engine: Κρίσιμη ευπάθεια CVE-2026-73267 https://secn.ws/0Kd3n2
Post summary
The text announces a critical vulnerability (CVE-2026-73267) but provides no further details, such as technical specifics, exploits, or patches.
00000129
7.0K followersView on X

Explore more

Back to dashboard