MCE ClusterCurator: a namespace-scoped tenant admin can mint a cluster-admin ServiceAccount token

Impact

Creating a namespaced ClusterCurator object causes the controller to hand the creator the ability to mint a token for a ServiceAccount that holds cluster-wide admin authority. That collapses the namespace boundary entirely: a tenant who was given admin only inside their own project ends up with full control of the hub cluster and, through MCE, of the managed clusters it drives. On a GPU fleet where namespaces are the tenancy model and MCE is what provisions and upgrades the clusters, this is the difference between one tenant's workloads and every node in the estate. No exotic access is needed - the escalation is a side effect of a custom resource the tenant is already permitted to create.

Who can reach it

Network-reachable Kubernetes API with existing credentials (CVSS AV:N/PR:H): any tenant administrator holding namespace-scoped admin rights on a hub cluster running Multicluster Engine 2.11 who can create a ClusterCurator in their own namespace.

What to do

Apply the Multicluster Engine 2.11 update shipped as RHSA-2026:59556; the upgrade rolls the MCE operator and controller pods on the hub cluster. No node drain or reboot is involved. Until it is applied, the practical mitigation is to remove tenants' ability to create ClusterCurator resources in namespaces they administer and to audit existing ClusterCurator objects and issued ServiceAccount tokens.

References

Related entries

• Argo CD: Stored XSS via a `javascript:` link executes in an admin's browserCVE-2022-31035 · Argo CDCritical
• Argo CD: Improper authorization causes the API to accept tokens it should rejectCVE-2023-22482 · Argo CDCritical
• Argo CD: Improper URL protocol filtering in link annotations enables client-side attacks against adminsCVE-2024-28175 · Argo CDCritical
• Argo CD: An unprivileged pod in any namespace can reach the unauthenticated Argo CD Redis on 6379 and poisonCVE-2024-31989 · Argo CDCritical
• OpenChoreo cluster gateway: unauthenticated internal listener exposes cross-tenant secrets and pod execCVE-2026-73842 · OpenChoreo cluster gateway (internal /api/proxy, /api/exec, /api/wirelogs listener)Critical
• Argo Workflows (controller, podSpecPatch in Strict/Secure template reference mode): A podSpecPatch on the submittedCVE-2026-31892 · Argo Workflows (controller, podSpecPatch in Strict/Secure template reference mode)High