Technical impact
A flaw in the multicloud-operators-subscription component allows a user who can create a Subscription on a managed cluster to inject crafted annotations. These annotations are trusted by the controller's Service Account due to the isclusteradmin() function, enabling the attacker to deploy arbitrary resources into any namespace with the controller's elevated permissions. The vulnerability can result in unauthorized access to cluster resources and full control over the managed environment.
Affected Systems
Affected systems include Red Hat Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4, and Red Hat OpenShift Data Foundation 4. Version information is not provided in the advisory.
Risk and Exploitability
The CVSS score of 9.9 places this flaw in the critical range, indicating high impact on confidentiality, integrity, and availability. The EPSS score is not available, but the vulnerability’s nature suggests that an attacker already possessing a user role with rights to create Subscription objects can exploit it with minimal effort. Commercial exploitation is unlikely to be discovered yet because the issue is not listed in the CISA KEV catalog, yet the ease of deployment via normal cluster management tools makes it a high priority for patching. Inferred attack vector is local within the cluster, where a privileged user crafts a Subscription with malicious annotations to trigger the privileged controller.
