The vulnerability lies in the multicluster-global-hub-operator-bundle’s RBAC policy, which grants cluster‑wide impersonation rights for any user, group, or service account without restriction. An attacker who compromises the operator or obtains its service account credentials can use these permissions to impersonate privileged users, effectively gaining full administrative control of the cluster.

The flaw affects Red Hat Multicluster Global Hub installations that include the multicluster-global-hub-operator-bundle. Specific version details were not provided in the advisory; therefore any deployment that has not applied a recent patch remains vulnerable.

With a CVSS score of 7.2, the vulnerability presents a high severity risk. The EPSS score is not available, and the issue is not listed in CISA KEV, implying no confirmed public exploits yet. The likely attack vector involves a compromise of the operator or elevation of the bundled service account, from which an attacker can execute arbitrary actions across the cluster.