Technical impact
The OpenShift Cloud Credential Operator Mint‑mode IAM policies provision operator credentials with account‑wide scope for destructive actions. If the credentials are compromised, an attacker can perform destructive IAM operations beyond the intended cluster scope, potentially affecting any resource in the AWS account. This privilege escalation corresponds to CWE‑250, which represents a misuse of privileges.
Affected Systems
The flaw affects Red Hat OpenShift Container Platform 4. No specific sub‑version ranges were defined in the advisory, so all installations running this platform that use Mint mode are potentially vulnerable.
Risk and Exploitability
The CVSS base score of 7.2 indicates a high severity, while the absence of an EPSS score means current data is limited but does not negate the risk. The vulnerability is not yet in the CISA KEV catalog, but it remains a significant risk for any cluster employing Mint mode. Exploitation requires obtaining the operator credentials, which could be achieved through misconfiguration, insider threats, or credential theft. Once in possession, the attacker can issue destructive IAM actions across the entire AWS account.
