NVD CRITICAL: CVE-2026-73268 — A flaw was found in the cluster-curator-controller component of multicluster eng...
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected
CVE-2026-73268