The vulnerability lies in the ACL subsystem of kronosnet versions up to 1.34. When the framework is configured to accept dynamic links from any IP address without encrypting the payload, it implicitly trusts the link identifier supplied in received packets. An attacker who can transmit custom network frames can spoof a legitimate link ID, bypass the ACL mechanism, and inject arbitrary data into the application layer. This bypass is a classic access‑control flaw (CWE-290) and can cause data corruption or service instability.

Affected products include Red Hat Enterprise Linux 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, all of which may run kronosnet 1.34 or earlier.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of 0.00165 (approximately 0.17%) indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, over the network, and requires no authentication; it exploits a misconfiguration that allows unencrypted dynamic links. While the impact is confined to the application layer, successful exploitation could corrupt data or destabilize services. Organizations that still run the vulnerable kronosnet version with open dynamic links should evaluate the potential impact immediately.