CVE-2026-73266 is a cross-tenant authorization bypass in Red Hat Advanced Cluster Management for Kubernetes (ACM) and Multicloud Engine (MCE). The vulnerability stems from ManagedClusterSet membership being derivable from ClusterClaim labels, which are tenant-writable. By mutating these labels during cluster registration, an authenticated tenant can assign their cluster to a ManagedClusterSet they do not own, thereby inheriting policy namespaces and resource quotas from other tenant scopes. This collapses the hard isolation boundary that multi-tenancy is supposed to enforce.
The CVSS 7.1 rating is analytically misleading for multi-tenant deployments. The description explicitly frames this as cross-tenant unauthorized access, which under CVSS methodology should trigger scope change — pushing the rating to Critical. The current score reflects a single-tenant administrative domain assumption that does not hold in brokered MCE environments. Treat this as Critical regardless of what your vulnerability scanner reports.
Additionally, the 'authenticated attacker' prerequisite should not reassure defenders. In typical MCE deployments, tenant authentication extends to service accounts and CI/CD pipelines with cluster registration permissions. Compromising a build pipeline or workload provides sufficient access — no privileged human identity required. The EPSS 0.0016 reflects current exploit maturity, not post-disclosure trajectory; once proof-of-concept code circulates, the probability of active exploitation converges rapidly.
Your remediation priorities: First, determine whether the patch removes ClusterClaim label mutability from the authorization path entirely or merely adds server-side validation. The former is an architectural fix that constrains future developers; the latter is a band-aid that leaves the dangerous affordance open. Second, audit your MCE control plane for other paths where ClusterClaim labels are trusted for security-critical operations beyond cluster-set membership — policy distribution, namespace inheritance, and quota assignment are likely candidates. Third, given the cross-tenant blast radius, coordinate patch deployment at the hub level with urgency disproportionate to the CVSS score; your patching velocity directly determines your neighbors' exposure window in shared-hub deployments.