CyberRota Analysis
AI-GeneratedA vulnerability exists in the clusterclaims-controller component of the Multicluster Engine, allowing authenticated tenants to manipulate ClusterClaim labels. This exploitation can lead to unauthorized access, enabling one tenant to force a cluster to join another tenant's ManagedClusterSet, potentially injecting malicious policies and workloads. Organizations utilizing Multicluster Engine should prioritize addressing this issue to prevent cross-tenant security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.