Kuadrant Operator EUVD-2026-102322

Requires a multi-tenant deployment of Kuadrant / Red Hat Connectivity Link where multiple tenants share a Gateway, and the attacker must hold Kubernetes/OpenShift RBAC permissions to create or modify an HTTPRoute attached to that shared Gateway. The specific trigger is supplying a crafted path, header, or query match value in the HTTPRoute that is not correctly escaped when the WASM shim generates the CEL predicate, causing the Gateway-level AuthPolicy and RateLimitPolicy checks to be skipped. Limiting factors that reduce real-world risk: authenticated RBAC on route objects is required (not anonymous), a shared/multi-tenant Gateway must be in use, and Gateway-level authentication and/or rate limiting must actually be configured - single-tenant clusters or deployments where route-management rights equal full trust are not meaningfully exposed.

This is a genuine but conditional-priority issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) and base score of 7.4 (High) reflect a low-privilege, network-reachable, scope-changing authentication/rate-limit bypass - the S:C (scope change) is the key driver, since a flaw in the Kuadrant WASM shim lets an attacker bypass security controls protecting a different authority (backend workloads behind a shared Gateway). However, PR:L is doing significant work here: exploitation requires the attacker to already hold Kubernetes/OpenShift RBAC rights to create or modify an HTTPRoute attached to a shared Gateway, which is an authenticated tenant-level capability, not anonymous internet access. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided intelligence, so this is best characterized as a tenant-isolation/privilege-escalation weakness in multi-tenant Gateway API deployments rather than an actively exploited, broadly scanned vulnerability. The CWE-917 (Expression Language / CEL injection) classification is consistent with the described mechanism: unescaped HTTPRoute match values are injected into the generated CEL predicate. One cross-signal tension worth noting: the metadata tag 'Information Disclosure' partially captures the effect (unauthorized backend reach) but understates it - the core impact is a security-control bypass that can also enable rate-limit evasion (A) and limited integrity effects (I), consistent with the balanced C:L/I:L/A:L impact set. Overall: a real priority for anyone running Kuadrant/Red Hat Connectivity Link with shared Gateways in a multi-tenant posture, but lower urgency for single-tenant or trusted-operator deployments.

In a multi-tenant OpenShift cluster, a tenant with permission to manage HTTPRoutes on a shared Gateway creates an HTTPRoute whose path, header, or query match value contains crafted characters that break out of the generated CEL predicate string. The malformed predicate causes Kuadrant's WASM shim to evaluate as 'skip', so Gateway-level authentication and rate limiting are not applied, yet the request is still forwarded to the backend. No public proof-of-concept is identified in the provided data; exploitation requires authenticated RBAC to edit routes, so it is low-complexity but not anonymous.