Red Hat RHACS EUVD-2026-55617

Exploitation requires that the target RHACS 4 deployment has the Machine-to-Machine (M2M) token exchange feature enabled and that an administrator has defined at least one M2M role mapping using OIDC claim-based pattern matching. The attacker must possess a valid OIDC token from an identity provider trusted by that specific RHACS instance, and the token's relevant claim value must be a superstring of a configured mapping pattern string - the attacker's claim must contain the pattern as a substring without being identical to it. The CVSS PR:L rating confirms that possession of at least a valid (low-privilege) authenticated OIDC token is required; fully unauthenticated exploitation is not possible. RHACS deployments that do not use the M2M token exchange feature, or that have no M2M role mappings configured, are not affected by this vulnerability regardless of OIDC configuration.

The CVSS 6.8 score and vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N accurately characterize a moderate-to-elevated real-world risk: network reachability and high confidentiality and integrity impact are serious, but AC:H reflects a genuine prerequisite that the attacker must know or infer the target's M2M regex patterns and control a claim value that satisfies the superstring condition. No EPSS score was supplied in the available intelligence data, and neither CISA KEV listing nor publicly available proof-of-concept code has been identified at this time - these absences meaningfully reduce immediate exploitation urgency compared to a KEV-listed flaw. Because the vulnerability resides within a security-focused Kubernetes management plane, the blast radius of a successful privilege escalation is disproportionately high relative to the raw CVSS score; even a mid-sized municipal IT team in gniezno running RHACS to enforce cluster policy should treat this as urgent, since an attacker gaining unauthorized RHACS roles could suppress alerts, modify admission policies, or enumerate sensitive cluster configurations. The zero availability impact (A:N) is consistent with the nature of unauthorized role assignment rather than service disruption.

An attacker who holds a valid OIDC token issued by a trusted identity provider accepted by the target RHACS instance - for example, a legitimate low-privilege service account with a claim value of 'dev-admin-svc' - discovers through configuration disclosure or trial-and-error that the M2M role mapping includes an unanchored pattern for 'admin'. Because the regex matches substrings, the token exchange succeeds and the attacker receives the 'admin' role's privileges. No public proof-of-concept code has been identified, but the exploitation logic is straightforward for any attacker familiar with OIDC token structure and RHACS role mapping semantics.