Red Hat Connectivity Link 1
Monthly
Kuadrant operator's internal WebAssembly shim can be made to skip Gateway-level authentication and rate-limiting checks in multi-tenant deployments when an authenticated user with Kubernetes/OpenShift RBAC permission to create or modify an HTTPRoute attached to a shared Gateway supplies a crafted path, header, or query match value. The value is not properly escaped during CEL predicate generation, so the predicate can be altered to bypass those policies while the request is still forwarded to the route backend. No public exploit identified at time of analysis, and exploitation is conditional on a shared/multi-tenant Gateway with Gateway-level auth and/or rate limiting configured, making this a genuine but conditional-priority issue rather than a mass-exploitation threat.
Kuadrant operator's internal WebAssembly shim can be made to skip Gateway-level authentication and rate-limiting checks in multi-tenant deployments when an authenticated user with Kubernetes/OpenShift RBAC permission to create or modify an HTTPRoute attached to a shared Gateway supplies a crafted path, header, or query match value. The value is not properly escaped during CEL predicate generation, so the predicate can be altered to bypass those policies while the request is still forwarded to the route backend. No public exploit identified at time of analysis, and exploitation is conditional on a shared/multi-tenant Gateway with Gateway-level auth and/or rate limiting configured, making this a genuine but conditional-priority issue rather than a mass-exploitation threat.