Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Advanced Cluster Management for Kubernetes 2.11
Vendor
Red Hat
Product
Red Hat Advanced Cluster Management for Kubernetes 2.11
Platforms
Unknown
Default status
affected
Package
rhacm2/multicluster-operators-subscription-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Advanced Cluster Management for Kubernetes 2.11 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787263584
unaffected
rpm
*
Unavailable
None listed
Red Hat Advanced Cluster Management for Kubernetes 2.13
Vendor
Red Hat
Product
Red Hat Advanced Cluster Management for Kubernetes 2.13
Platforms
Unknown
Default status
affected
Package
rhacm2/multicluster-operators-subscription-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Advanced Cluster Management for Kubernetes 2.13 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787263693
unaffected
rpm
*
Unavailable
None listed
Red Hat Advanced Cluster Management for Kubernetes 2.14
Vendor
Red Hat
Product
Red Hat Advanced Cluster Management for Kubernetes 2.14
Platforms
Unknown
Default status
affected
Package
rhacm2/multicluster-operators-subscription-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Advanced Cluster Management for Kubernetes 2.14 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787170830
unaffected
rpm
*
Unavailable
None listed
Red Hat Advanced Cluster Management for Kubernetes 2.15
Vendor
Red Hat
Product
Red Hat Advanced Cluster Management for Kubernetes 2.15
Platforms
Unknown
Default status
affected
Package
rhacm2/multicluster-operators-subscription-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Advanced Cluster Management for Kubernetes 2.15 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787240030
unaffected
rpm
*
Unavailable
None listed
Red Hat Advanced Cluster Management for Kubernetes 2.16
Vendor
Red Hat
Product
Red Hat Advanced Cluster Management for Kubernetes 2.16
Platforms
Unknown
Default status
affected
Package
rhacm2/multicluster-operators-subscription-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Advanced Cluster Management for Kubernetes 2.16 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787242321
unaffected
rpm
*
Unavailable
None listed
Red Hat Advanced Cluster Management for Kubernetes 2.17
Vendor
Red Hat
Product
Red Hat Advanced Cluster Management for Kubernetes 2.17
Platforms
Unknown
Default status
affected
Package
rhacm2/multicluster-operators-subscription-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Advanced Cluster Management for Kubernetes 2.17 · Scoped product and version facts