Is CVE-2026-73266 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73266?

CVE-2026-73266 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-73266

Description

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.