volsync-addon-controller CVE-2026-18874

Three explicit conditions must all be met: (1) the cluster must have VolSync deployed in OLM mode, indicated by the 'volsync-addon-deploy-type: olm' annotation being explicitly set - this is a non-default configuration absent from standard VolSync deployments; (2) the attacker must possess high-privilege cluster credentials sufficient to write or influence annotation values on the relevant Kubernetes resources (PR:H per CVSS); (3) the attack complexity is rated High (AC:H), reflecting the specific injection payload crafting and timing conditions required. Exploitation is not possible against default VolSync deployments that do not use the OLM addon controller path. The high privilege prerequisite means this is not an initial access vector - it is relevant in post-compromise, insider threat, or misconfigured RBAC scenarios. Authentication requirements are confirmed as high-privilege by the CVSS PR:H metric.

The CVSS 6.2 score reflects the genuine constraints this vulnerability carries: the network attack vector (AV:N) is offset by high attack complexity (AC:H) and high privilege requirements (PR:H), meaning an attacker must already hold significant cluster access before this flaw becomes exploitable. The non-default deployment condition - the 'volsync-addon-deploy-type: olm' annotation must be explicitly set - further limits the exposed population to a subset of VolSync deployments, excluding default or non-OLM installations. The I:H and A:H impact ratings are serious in context: successful injection into OLM Subscription resources could redirect operator installation to a malicious catalog source or destabilize cluster operator lifecycle management. No EPSS data was provided and no KEV listing is present, which is consistent with the high privilege barrier reducing opportunistic exploitation likelihood. The RCE tag from the reporter is an editorial classification; while YAML injection into operator config can have code-execution-adjacent effects through operator behavior, direct RCE at the process level is not confirmed from available data. This vulnerability is best treated as a medium-priority finding requiring cluster-privileged access - meaningful in post-compromise or insider-threat scenarios, but not a perimeter risk.

An attacker with high-privilege access to an OpenShift cluster running VolSync in OLM mode crafts a Kubernetes annotation value containing YAML newline injection sequences - for example, embedding a newline followed by a new YAML key such as 'source: attacker-catalog' - which volsync-addon-controller then interpolates unescaped into a generated OLM Subscription manifest. The resulting malformed Subscription document instructs OLM to install or update the operator from an attacker-controlled catalog source, enabling supply-chain compromise of cluster operators. No public proof-of-concept has been identified at time of analysis.