CVE-2026-73267: Clusterclaim Controller Unvalidated Managedcluster Deletion

ManagedCluster deletion is performed based on target namespace without validating ClusterDeployment ownership via ClusterPoolRef against the ClusterClaim.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0Go
greprules fetch cve-2026-73267-clusterclaim-controller-unvalidated-managedcluster-deletion --engine opengrep

Description

ManagedCluster deletion is performed based on target namespace without validating ClusterDeployment ownership via ClusterPoolRef against the ClusterClaim.