Red Hat Advanced Cluster Management For Kubernetes 2
Monthly
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Cross-namespace secret disclosure in Red Hat Advanced Cluster Management for Kubernetes allows a managed-cluster agent holding low privileges to craft configuration references that point to hub Secrets outside its authorized namespace, delivering those Secrets to an attacker-controlled managed cluster. The vulnerability resides in the multicluster-observability-addon component, which previously processed ManagedClusterAddOn.status.configReferences and fetched referenced objects before enforcing any namespace boundary, allowing cross-cluster credential theft from the hub. The upstream fix (PR #644) introduces ValidateConfigNamespaces() to reject out-of-scope references before manifest generation; no public exploit has been identified at time of analysis.
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat.
Credential exfiltration in RHACM's multicloud-operators-subscription component allows an authenticated tenant with HelmRelease create permissions to bypass Kubernetes namespace isolation by manipulating the `secretRef.Namespace` field, causing the HelmRelease controller to fetch Secrets from arbitrary namespaces and transmit them to an attacker-controlled Helm repository. The CVSS S:C (scope changed) metric confirms this breaks the namespace boundary that Kubernetes multi-tenancy depends on, enabling low-privileged lateral movement across namespace security domains. No public exploit or CISA KEV active exploitation listing is confirmed at time of analysis; however, the attack is mechanically straightforward for any cluster account holding the requisite RBAC permission.
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but the credential-theft and supply-chain propagation potential make this a high-priority finding for organizations actively running ACM 2.x build pipelines.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod execution under the `search-serviceaccount` service account to impersonate `system:masters` and gain full cluster-admin control. The `search-serviceaccount` RBAC bindings grant cluster-wide `impersonate` permissions on users and groups - a grossly over-privileged configuration that collapses the entire cluster's security boundary if any pod running under this account is compromised. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV, but the CVSS scope change (S:C) and full CIA triad impact (C:H/I:H/A:H) accurately reflect the catastrophic blast radius of successful exploitation.
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory exhaustion in Red Hat Advanced Cluster Management for Kubernetes 2's search-v2-api component allows unauthenticated remote attackers to crash the search-api pod by submitting HTTP requests with unique random bearer tokens. Each unique token creates a permanent, uncleaned entry in the unbounded tokenReviews cache; sustained submission accumulates entries until the pod exhausts available memory and is killed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated exploitability with no prerequisites. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity makes automated exploitation straightforward.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search collector) allows a hub-cluster administrator holding patch access to the Search Custom Resource to abuse the unvalidated Collector.ImageOverride field to push an attacker-chosen container image to every managed cluster in the fleet. Because the override is trusted and propagated hub-to-spoke, a single malicious CR edit yields command execution across all connected clusters, with the CVSS scope-change flag reflecting the jump from the hub trust boundary into separate managed-cluster security authorities. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
Unauthenticated information disclosure affects the Multicluster Observability Addon in Red Hat Advanced Cluster Management for Kubernetes, enabling attackers on the adjacent network to access a debug endpoint that leaks goroutine, heap, and command-line profiling data. The misconfiguration originates in the underlying addon-framework library, which exposes the endpoint without requiring credentials; exploitation only requires a basic encrypted (TLS) connection. No public exploit has been identified at time of analysis, and the vulnerability does not permit remote code execution, but the exposed profiling information could aid reconnaissance or further attacks.
Cross-tenant TLS configuration leakage in flightctl (shipped as Red Hat Edge Manager 1 and embedded in Red Hat Advanced Cluster Management for Kubernetes 2) lets an authenticated organization user have their HTTPS git repository's TLS settings - potentially InsecureSkipVerify, a custom CA bundle, or their own mTLS client certificate - applied to another organization's concurrent git.Clone operations, because the device-render worker installs each per-repository tls.Config into go-git's process-global Protocols map. Exploitation requires a multi-tenant deployment that renders devices for several organizations concurrently from a shared goroutine pool and is inherently non-deterministic (AC:H) since the attacker cannot control which tenant's configuration wins; single-tenant or serialized-rendering deployments are not exposed. The vendor scores this 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) while our independent assessment rates privileges as PR:L because defining an HTTPS git repository only needs a normal authenticated tenant/organization account; no public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided.
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.
Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) allows a malicious or compromised member cluster to hijack traffic from peer clusters by advertising a specially crafted network endpoint. Because Submariner does not validate the subnets a spoke cluster declares, an attacker-controlled cluster can claim arbitrary CIDR ranges and cause peer clusters to route all matching traffic through the attacker's tunnel, enabling information disclosure and denial of connectivity. Rated CVSS 9.9 with a changed scope, this affects the multicluster networking layer, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-cluster data integrity violation in Red Hat Advanced Cluster Management for Kubernetes 2 allows a registered and authenticated managed cluster to tamper with or delete indexed search data belonging to other clusters. The flaw resides in the delta-sync write paths of the search-indexer component, which fails to enforce cluster-scoped ownership checks before processing UPDATE and DELETE operations. With no public exploit identified at time of analysis and no CISA KEV listing, the practical risk is bounded by the requirement for an already-registered cluster credential, though the Changed scope (S:C) elevates concern in multi-tenant fleet environments where cluster isolation is an assumed security boundary.
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) allows a single compromised member cluster to overwrite the endpoint records of other clusters in the mesh. Because the submariner-k8s-broker-cluster Role granted to every joined cluster carries more write access than it needs, an attacker holding one cluster's broker credentials can reroute inter-cluster tunnel traffic through attacker-controlled endpoints and mount a mesh-wide man-in-the-middle. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.x allows a cluster administrator-or any user holding RBAC permissions to modify the Submariner Custom Resource-to reference an unvalidated, attacker-controlled container image path, causing the operator to deploy and execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes. The root cause (CWE-20: Improper Input Validation) is the absence of image path sanitization or verification before the operator acts on the Submariner CR field, enabling privilege escalation beyond the user's intended cluster boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the Changed Scope with full C:H/I:H/A:H impact ratings signal potential for complete cluster compromise once the high-privilege prerequisite is met.
Cleartext storage of a long-lived broker service account bearer token in the Submariner Custom Resource specification exposes full mesh network control to any Kubernetes principal with CR read access. Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) is confirmed affected via CPE. An attacker who retrieves the token - through a routine `kubectl get` invocation or direct etcd access - gains unrestricted authority to manage Submariner endpoints, secrets, and cross-cluster network resources, constituting a complete compromise of the multi-cluster network plane. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cleartext storage of the IPsec pre-shared key (PSK) in the Submariner Custom Resource exposes the cryptographic secret used to secure all inter-cluster communication in Red Hat Advanced Cluster Management for Kubernetes 2 deployments. Any principal with low-privilege read access to the Submariner CR object within the Kubernetes cluster can retrieve the PSK and use it to passively decrypt IPsec-encrypted traffic flowing between every cluster in the connected mesh - not just the cluster where access was obtained (CVSS scope change S:C). No public exploit code exists and the vulnerability is not listed in CISA KEV, but the architectural impact is severe: a single stolen key compromises the confidentiality of all inter-cluster traffic simultaneously.
Credential exposure in Red Hat Advanced Cluster Management for Kubernetes 2.x allows any local user with access to a must-gather diagnostic archive to read proxy basic-auth credentials in plaintext. The must-gather component dumps the cluster Proxy object in raw form, bypassing the redaction logic that oc inspect would normally apply to sanitize sensitive fields before archiving. No public exploit code exists and this is not listed in CISA KEV, but the CVSS AV:L/PR:L vector confirms real-world exposure is bounded to archive access rather than remote exploitation.
Cleartext credential exposure in Red Hat Advanced Cluster Management for Kubernetes affects the must-gather diagnostic tool, which collects ACM wrapper Custom Resources containing embedded Secret data without scrubbing sensitive fields. Any administrator who runs must-gather to diagnose cluster issues inadvertently captures credentials and tokens in the resulting archive, which may then be stored, shared, or transmitted without awareness of the embedded secrets. No public exploit identified at time of analysis, but the information disclosure risk is compounded by the routine, trust-assumed nature of diagnostic archive handling.
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) enables an authenticated low-privileged user holding specific channel-related permissions to read or modify Kubernetes Secrets outside their authorized namespace scope. The CVSS S:C (Changed Scope) metric confirms the flaw crosses namespace trust boundaries - a critical boundary in multi-tenant Kubernetes environments - potentially exposing credentials, service account tokens, or application secrets belonging to other tenants, and enabling privilege escalation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Cross-namespace secret disclosure in Red Hat Advanced Cluster Management for Kubernetes allows a managed-cluster agent holding low privileges to craft configuration references that point to hub Secrets outside its authorized namespace, delivering those Secrets to an attacker-controlled managed cluster. The vulnerability resides in the multicluster-observability-addon component, which previously processed ManagedClusterAddOn.status.configReferences and fetched referenced objects before enforcing any namespace boundary, allowing cross-cluster credential theft from the hub. The upstream fix (PR #644) introduces ValidateConfigNamespaces() to reject out-of-scope references before manifest generation; no public exploit has been identified at time of analysis.
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat.
Credential exfiltration in RHACM's multicloud-operators-subscription component allows an authenticated tenant with HelmRelease create permissions to bypass Kubernetes namespace isolation by manipulating the `secretRef.Namespace` field, causing the HelmRelease controller to fetch Secrets from arbitrary namespaces and transmit them to an attacker-controlled Helm repository. The CVSS S:C (scope changed) metric confirms this breaks the namespace boundary that Kubernetes multi-tenancy depends on, enabling low-privileged lateral movement across namespace security domains. No public exploit or CISA KEV active exploitation listing is confirmed at time of analysis; however, the attack is mechanically straightforward for any cluster account holding the requisite RBAC permission.
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but the credential-theft and supply-chain propagation potential make this a high-priority finding for organizations actively running ACM 2.x build pipelines.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod execution under the `search-serviceaccount` service account to impersonate `system:masters` and gain full cluster-admin control. The `search-serviceaccount` RBAC bindings grant cluster-wide `impersonate` permissions on users and groups - a grossly over-privileged configuration that collapses the entire cluster's security boundary if any pod running under this account is compromised. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV, but the CVSS scope change (S:C) and full CIA triad impact (C:H/I:H/A:H) accurately reflect the catastrophic blast radius of successful exploitation.
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory exhaustion in Red Hat Advanced Cluster Management for Kubernetes 2's search-v2-api component allows unauthenticated remote attackers to crash the search-api pod by submitting HTTP requests with unique random bearer tokens. Each unique token creates a permanent, uncleaned entry in the unbounded tokenReviews cache; sustained submission accumulates entries until the pod exhausts available memory and is killed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated exploitability with no prerequisites. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity makes automated exploitation straightforward.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search collector) allows a hub-cluster administrator holding patch access to the Search Custom Resource to abuse the unvalidated Collector.ImageOverride field to push an attacker-chosen container image to every managed cluster in the fleet. Because the override is trusted and propagated hub-to-spoke, a single malicious CR edit yields command execution across all connected clusters, with the CVSS scope-change flag reflecting the jump from the hub trust boundary into separate managed-cluster security authorities. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticated tenant abuse the GitOpsCluster controller in the multicloud-integrations component to redirect spoke-cluster credentials into a namespace they control. Because the controller acts on the tenant's behalf across trust boundaries (a confused-deputy flaw), a low-privileged user can obtain tokens that grant access to managed spoke clusters and bypass ArgoCD AppProject scoping controls. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS base score is 9.6 (Critical).
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / ArgoCD pull-model integration) lets a low-privileged hub tenant who can create Application CRs redirect propagation to arbitrary managed spoke clusters. Because the Application propagation controller trusts the attacker-supplied `ocm-managed-cluster` annotation without validation, an attacker forces ArgoCD on targeted spokes to sync attacker-controlled manifests, yielding code execution or privilege escalation there. CVSS 9.9 with scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
Unauthenticated information disclosure affects the Multicluster Observability Addon in Red Hat Advanced Cluster Management for Kubernetes, enabling attackers on the adjacent network to access a debug endpoint that leaks goroutine, heap, and command-line profiling data. The misconfiguration originates in the underlying addon-framework library, which exposes the endpoint without requiring credentials; exploitation only requires a basic encrypted (TLS) connection. No public exploit has been identified at time of analysis, and the vulnerability does not permit remote code execution, but the exposed profiling information could aid reconnaissance or further attacks.
Cross-tenant TLS configuration leakage in flightctl (shipped as Red Hat Edge Manager 1 and embedded in Red Hat Advanced Cluster Management for Kubernetes 2) lets an authenticated organization user have their HTTPS git repository's TLS settings - potentially InsecureSkipVerify, a custom CA bundle, or their own mTLS client certificate - applied to another organization's concurrent git.Clone operations, because the device-render worker installs each per-repository tls.Config into go-git's process-global Protocols map. Exploitation requires a multi-tenant deployment that renders devices for several organizations concurrently from a shared goroutine pool and is inherently non-deterministic (AC:H) since the attacker cannot control which tenant's configuration wins; single-tenant or serialized-rendering deployments are not exposed. The vendor scores this 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) while our independent assessment rates privileges as PR:L because defining an HTTPS git repository only needs a normal authenticated tenant/organization account; no public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided.
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.
Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) allows a malicious or compromised member cluster to hijack traffic from peer clusters by advertising a specially crafted network endpoint. Because Submariner does not validate the subnets a spoke cluster declares, an attacker-controlled cluster can claim arbitrary CIDR ranges and cause peer clusters to route all matching traffic through the attacker's tunnel, enabling information disclosure and denial of connectivity. Rated CVSS 9.9 with a changed scope, this affects the multicluster networking layer, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-cluster data integrity violation in Red Hat Advanced Cluster Management for Kubernetes 2 allows a registered and authenticated managed cluster to tamper with or delete indexed search data belonging to other clusters. The flaw resides in the delta-sync write paths of the search-indexer component, which fails to enforce cluster-scoped ownership checks before processing UPDATE and DELETE operations. With no public exploit identified at time of analysis and no CISA KEV listing, the practical risk is bounded by the requirement for an already-registered cluster credential, though the Changed scope (S:C) elevates concern in multi-tenant fleet environments where cluster isolation is an assumed security boundary.
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) allows a single compromised member cluster to overwrite the endpoint records of other clusters in the mesh. Because the submariner-k8s-broker-cluster Role granted to every joined cluster carries more write access than it needs, an attacker holding one cluster's broker credentials can reroute inter-cluster tunnel traffic through attacker-controlled endpoints and mount a mesh-wide man-in-the-middle. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.x allows a cluster administrator-or any user holding RBAC permissions to modify the Submariner Custom Resource-to reference an unvalidated, attacker-controlled container image path, causing the operator to deploy and execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes. The root cause (CWE-20: Improper Input Validation) is the absence of image path sanitization or verification before the operator acts on the Submariner CR field, enabling privilege escalation beyond the user's intended cluster boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the Changed Scope with full C:H/I:H/A:H impact ratings signal potential for complete cluster compromise once the high-privilege prerequisite is met.
Cleartext storage of a long-lived broker service account bearer token in the Submariner Custom Resource specification exposes full mesh network control to any Kubernetes principal with CR read access. Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) is confirmed affected via CPE. An attacker who retrieves the token - through a routine `kubectl get` invocation or direct etcd access - gains unrestricted authority to manage Submariner endpoints, secrets, and cross-cluster network resources, constituting a complete compromise of the multi-cluster network plane. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cleartext storage of the IPsec pre-shared key (PSK) in the Submariner Custom Resource exposes the cryptographic secret used to secure all inter-cluster communication in Red Hat Advanced Cluster Management for Kubernetes 2 deployments. Any principal with low-privilege read access to the Submariner CR object within the Kubernetes cluster can retrieve the PSK and use it to passively decrypt IPsec-encrypted traffic flowing between every cluster in the connected mesh - not just the cluster where access was obtained (CVSS scope change S:C). No public exploit code exists and the vulnerability is not listed in CISA KEV, but the architectural impact is severe: a single stolen key compromises the confidentiality of all inter-cluster traffic simultaneously.
Credential exposure in Red Hat Advanced Cluster Management for Kubernetes 2.x allows any local user with access to a must-gather diagnostic archive to read proxy basic-auth credentials in plaintext. The must-gather component dumps the cluster Proxy object in raw form, bypassing the redaction logic that oc inspect would normally apply to sanitize sensitive fields before archiving. No public exploit code exists and this is not listed in CISA KEV, but the CVSS AV:L/PR:L vector confirms real-world exposure is bounded to archive access rather than remote exploitation.
Cleartext credential exposure in Red Hat Advanced Cluster Management for Kubernetes affects the must-gather diagnostic tool, which collects ACM wrapper Custom Resources containing embedded Secret data without scrubbing sensitive fields. Any administrator who runs must-gather to diagnose cluster issues inadvertently captures credentials and tokens in the resulting archive, which may then be stored, shared, or transmitted without awareness of the embedded secrets. No public exploit identified at time of analysis, but the information disclosure risk is compounded by the routine, trust-assumed nature of diagnostic archive handling.
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) enables an authenticated low-privileged user holding specific channel-related permissions to read or modify Kubernetes Secrets outside their authorized namespace scope. The CVSS S:C (Changed Scope) metric confirms the flaw crosses namespace trust boundaries - a critical boundary in multi-tenant Kubernetes environments - potentially exposing credentials, service account tokens, or application secrets belonging to other tenants, and enabling privilege escalation. No public exploit code and no CISA KEV listing have been identified at time of analysis.