Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
multicluster engine for Kubernetes 2.10
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.10
Platforms
Unknown
Default status
affected
Package
multicluster-engine/cluster-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.10 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784342329
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.10
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.10
Platforms
Unknown
Default status
affected
Package
multicluster-engine/cluster-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.10 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784342329
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.11
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.11
Platforms
Unknown
Default status
affected
Package
multicluster-engine/cluster-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.11 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784925025
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.17
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.17
Platforms
Unknown
Default status
affected
Package
multicluster-engine/cluster-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.17 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784926298
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.6
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.6
Platforms
Unknown
Default status
affected
Package
multicluster-engine/cluster-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.6 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1783985960
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.8
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.8
Platforms
Unknown
Default status
affected
Package
multicluster-engine/cluster-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.8 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784342329
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.9
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.9
Platforms
Unknown
Default status
affected
Package
multicluster-engine/cluster-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.9 · Scoped product and version facts