Technical impact
Completed pods that have a restartPolicy set to Never are not counted against the ResourceQuota pod limits, and Kubernetes events generated by those pods are not scoped to any quota. This flaw, classified as a resource exhaustion weakness (CWE‑770), allows a user with permission to create pods to intentionally submit a large volume of such pods, leading to an accumulation of events in the cluster’s etcd store and causing observable degradation of the API server’s performance.
Affected Systems
The vulnerability affects Red Hat OpenShift Container Platform 4. No specific version range is listed, so all current releases of this platform are potentially impacted.
Risk and Exploitability
The CVSS score of 5 indicates a medium severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The likely attack vector is any non‑privileged user who can create pods in a namespace; by repeatedly creating pods with restartPolicy Never, an attacker can flood etcd with events, resulting in cluster‑wide API degradation. The risk is moderate, driven primarily by the ability to consume cluster resources and degrade services, and it requires only the ability to create pods, which is a common permission for many users.
