External risk intelligence

MCE Cluster Curator Job Injection Leading to Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-73268

The vulnerability exists within the cluster-curator-controller component of a multicluster engine, which is an internal orchestration and management layer. While network-accessible, such controllers are typically deployed within private, protected cluster environments, not directly exposed to the public internet.

Code Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the cluster management software that could allow unauthorized users to execute arbitrary code with elevated privileges, potentially exposing sensitive cluster-wide information. The core issue lies in how user-provided specifications are processed, allowing for the injection of malicious commands.

Insecurely processed commands can lead to code execution.
It impacts cluster management software.
Confirm relevance and exposure to sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker with permission to create or update certain cluster resources can leverage a flaw in the cluster-curator-controller to inject a malicious job specification. This occurs because the system doesn't properly check the job details provided by the user. If successful, this injected job runs with high privileges, potentially allowing the attacker to execute arbitrary code and access sensitive information across the cluster.

Tenant needs create/update permissions.
Unvalidated user input in job specification.
Arbitrary code execution and privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

A tenant with specific permissions could inject a malicious Job specification into the cluster-curator-controller. This flaw allows arbitrary code execution and privilege escalation when the controller processes the untrusted input, potentially exposing cluster-wide secrets.

Cluster-wide secrets.
Injecting Job spec into controller.
Code execution and privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The cluster-curator-controller component within multicluster engine (MCE) is likely managed by a platform or infrastructure team responsible for cluster orchestration. The immediate priority is to identify all instances of this component, assess their reachability and criticality, and then locate the specific teams or individuals accountable for its management and security. Remediation planning should then align with the identified risks.

Platform/Infrastructure teams own the issue.
Verify component reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the multicluster engine (MCE) and its cluster-curator-controller?

MCE is a software platform designed to manage and orchestrate multiple Kubernetes clusters from a centralized location. The cluster-curator-controller is a specific component within this engine responsible for automating tasks across those clusters, such as applying configurations or running maintenance jobs.

How does CVE-2026-73268 represent a code injection weakness?

This vulnerability falls under CWE-94, which involves improper control of generation of code. In this specific case, the controller fails to validate input when processing user-provided job specifications. Because it trusts this data, an attacker can supply a malicious job definition that the system executes as if it were legitimate code.

Does any user trigger this vulnerability?

No. The flaw is not triggered by just any user; it requires a tenant who already possesses specific authorization to create or update ClusterCurator resources. Without these existing permissions to define jobs, an attacker cannot inject the malicious specification required to initiate the attack.

Is my cluster at risk according to Halo Surface Signal?

Halo Surface Signal labels the risk as unlikely because the cluster-curator-controller is an internal management component. While it may technically be network-accessible, it is typically housed within private, protected infrastructure rather than being directly exposed to the public internet.

What should I do if I am running MCE?

You should coordinate with your platform or infrastructure teams to identify where the cluster-curator-controller is deployed in your environment. Once located, assess who has permissions to modify ClusterCurator resources and prioritize planning for security updates or configuration changes based on your specific risk profile.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.