Red Hat Edge Manager 1
Monthly
Cross-tenant TLS configuration leakage in flightctl (shipped as Red Hat Edge Manager 1 and embedded in Red Hat Advanced Cluster Management for Kubernetes 2) lets an authenticated organization user have their HTTPS git repository's TLS settings - potentially InsecureSkipVerify, a custom CA bundle, or their own mTLS client certificate - applied to another organization's concurrent git.Clone operations, because the device-render worker installs each per-repository tls.Config into go-git's process-global Protocols map. Exploitation requires a multi-tenant deployment that renders devices for several organizations concurrently from a shared goroutine pool and is inherently non-deterministic (AC:H) since the attacker cannot control which tenant's configuration wins; single-tenant or serialized-rendering deployments are not exposed. The vendor scores this 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) while our independent assessment rates privileges as PR:L because defining an HTTPS git repository only needs a normal authenticated tenant/organization account; no public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided.
Cross-tenant TLS configuration leakage in flightctl (shipped as Red Hat Edge Manager 1 and embedded in Red Hat Advanced Cluster Management for Kubernetes 2) lets an authenticated organization user have their HTTPS git repository's TLS settings - potentially InsecureSkipVerify, a custom CA bundle, or their own mTLS client certificate - applied to another organization's concurrent git.Clone operations, because the device-render worker installs each per-repository tls.Config into go-git's process-global Protocols map. Exploitation requires a multi-tenant deployment that renders devices for several organizations concurrently from a shared goroutine pool and is inherently non-deterministic (AC:H) since the attacker cannot control which tenant's configuration wins; single-tenant or serialized-rendering deployments are not exposed. The vendor scores this 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) while our independent assessment rates privileges as PR:L because defining an HTTPS git repository only needs a normal authenticated tenant/organization account; no public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided.