A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this v…

A critical privilege escalation vulnerability was discovered in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with only namespace-scoped privileges can exploit this flaw by creating a namespaced ClusterCurator resource. This inadvertently allows the attacker to mint a token for a ServiceAccount that holds cluster-wide administrative authority. The result is a full privilege escalation, granting the tenant administrator complete control over the entire Kubernetes cluster. This vulnerability poses a significant risk in multi-tenant Kubernetes environments where namespace isolation is expected to restrict administrative actions. The issue is tracked under CVE-2026-10059 and has been reported via Red Hat's security advisory and Bugzilla tracking systems.