The vulnerability lies in the way StackRox/RHACS Central processes machine‑to‑machine (M2M) role mappings during token exchange. When administrators create role mappings, the system evaluates claim values against regular expressions that are not anchored. Consequently, if an attacker possesses an OpenID Connect token whose claim value contains a superstring of a configured pattern, the unanchored regex will match and assign the attacker a role that the administrator did not intend to grant. This improper input validation directly enables a privilege escalation attack within the RHACS Central system, as described by CWE‑625.

Red Hat Advanced Cluster Security 4 (RHACS Central) is the affected product. Any deployment that relies on StackRox or RHACS Central for authenticating M2M tokens with custom role mappings is vulnerable, as the flaw resides in the central authentication component.

The CVSS score of 6.8 indicates moderate severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. The attack requires a valid OIDC token and the presence of an unanchored regex in a role mapping, implying that the threat surface is limited to scenarios where administrators have improperly configured mappings or attackers can generate tokens that match superstring patterns. Overall, the risk is moderate, with a reliance on administrative oversight to mitigate exposure.