A flaw allows a user with deploy creation rights to set the openshift.io/encoded-deployment-config label to "null" during Kubernetes Deployment processing. ACS interprets this as an empty UID, name, labels and default namespace, causing the workload to be treated as if it had no identity. This circumvents deploy‑time policy detection, disables enforcement visibility, and corrupts persistence in Central, breaking violation reporting and compliance correlation. The weakness is an indirect object access via parameter tampering (CWE‑345).

Red Hat Advanced Cluster Security for Kubernetes version 4 (Red Hat Advanced Cluster Security 4). The vulnerability is reported for all installations of this product; specific version ranges are not enumerated in the advisory.

The CVSS score of 8.5 indicates a high severity flaw. The EPSS score of less than 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in CISA KEV. An attacker must have permission to create Deployments but does not require additional privileges; therefore the attack vector is authenticated (user‑initiated) with local cluster scope. Once the label is set to null, ACS fails to enforce policies and reports, presenting a significant integrity risk for impacted clusters.