Technical impact
A flaw was discovered in the OpenShift Router that allows a user with write access to EndpointSlices to create a Service backed by an FQDN EndpointSlice. If the FQDN resolves to a cloud metadata endpoint, the router proxies the request to that endpoint, exposing instance credentials and other sensitive metadata. This functionality bypasses prior validation of destination IP addresses, enabling a server side request forgery that can leak privileged data.
Affected Systems
The vulnerability affects Red Hat OpenShift Container Platform 4. Any deployment of this version that has the router component and permits write access to EndpointSlices is potentially impacted.
Risk and Exploitability
The CVSS score of 7.7 indicates a high severity, and while the EPSS score is unavailable, the lack of inclusion in the CISA KEV catalog suggests no publicly known exploits yet. Attacks require an attacker to create or modify an EndpointSlice with a malicious FQDN and possess write permissions to inject it into the router's service definition. Once configured, the router will make outbound HTTP requests to the resolved metadata service, exposing credentials in the cluster.
