A flaw in the HyperShift operator allows an authenticated user who can create cluster and secret resources to supply a Kubernetes configuration containing unauthorized executable plugins, which the operator copies directly into the privileged control plane namespace without validation or sanitization. This results in the ability to execute arbitrary code within the control plane, posing a severe confidentiality, integrity, and availability risk. The weakness is characterized by the Common Weakness Enumeration ID CWE‑20, representing an input validation flaw.

Red Hat Multicluster Engine for Kubernetes is affected by this vulnerability. No specific version information is provided, indicating that the issue potentially exists across all supported releases that implement the HyperShift operator.

The CVSS base score of 8.8 indicates a high severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation data yet. The likely attack vector requires authenticated cluster‑level permissions that can create secrets, a common privilege for tenant tenants. Due to the lack of an official fix or workaround, the risk remains high until a vendor patch is released or a manual mitigation is applied.