Description

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-12T20:17:53.793Z",
  "pubdate": "2026-08-12T20:17:53.793Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified within the cluster-curator-controller component, exposing clusters to significant security risks through unauthorized cluster-scoped access.\nThe vulnerability allows a local user with restricted, namespace-local access to achieve full cluster-wide control.\nExploitation is driven by manipulating resource naming conventions when creating a ClusterCurator resource, which improperly triggers the automated creation of a cluster-scoped ClusterRoleBinding.\nThe impact of this flaw is severe, granting attackers broad permissions that encompass reading and manipulating sensitive secrets, orchestrating management actions across the infrastructure, and executing destructive operations such as deleting hosted clusters or node pools.\nRisk implications are high as multi-tenant isolation boundaries can be easily bypassed by unprivileged or localized users.\nAttacker capabilities require baseline namespace-local access to instantiate the malicious resource, after which automated controller logic handles the privilege escalation without requiring advanced exploitation vectors or network-based attacks.",
  "technicalDetails": "The root cause of the vulnerability resides in the validation and authorization logic of the cluster-curator-controller component, specifically how it handles incoming ClusterCurator resource creation requests.\nThe vulnerable component fails to properly validate and restrict user-supplied naming conventions against security boundaries when processing these resources.\nAn authenticated local user possessing only namespace-local permissions can initiate the attack flow by crafting and submitting a specifically named ClusterCurator resource.\nUpon processing the resource, the controller inadequately isolates the naming pattern and automatically provisions a cluster-scoped ClusterRoleBinding tied to the user-controlled parameters.\nBecause the resulting ClusterRoleBinding operates at the cluster scope rather than being restricted to the local namespace, it effectively grants elevated administrative privileges to the initiating entity.\nThe authentication and privilege requirements for exploitation are minimal; the attacker only needs localized, namespace-scoped access to create the initial ClusterCurator object.\nNo network exposure or remote exploitation is strictly required, as the vector is driven through standard API interactions available to authorized local principals.\nPost-exploitation impact includes complete compromise of the affected environment, enabling the adversary to access and manipulate cluster secrets, manage arbitrary cluster actions, and execute high-impact destructive tasks such as terminating hosted clusters and node pools."
}