Executive Summary

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster's ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster. This vulnerability has a CVSS score of 7.7 and is considered HIGH severity.

Technical Analysis

The vulnerability class is a cross-namespace authorization issue. The attack vector involves a user with permission to modify a managed cluster's ManagedClusterAddOn configuration. The vulnerable component is multicluster-observability-addon. The root cause is a lack of proper authorization checks when referencing ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace.

How It Gets Exploited

An attacker with permission to modify a managed cluster's ManagedClusterAddOn configuration can reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster. For example, an attacker could send a crafted configuration update to the ManagedClusterAddOn, referencing a ClusterLogForwarder resource in a different namespace that points to a Secret. The add-on would then potentially copy that Secret to the attacker-controlled cluster.

Impact Assessment

The affected products include Red Hat Advanced Cluster Management for Kubernetes 2 and multicluster-observability-addon. An attacker could achieve sensitive information disclosure, potentially leading to further exploitation. The CVSS score is 7.7, indicating a HIGH severity vulnerability.

Recommended Actions

Update multicluster-observability-addon to a version that includes the fix, such as updating to a commit hash like ad36a3ba9fd946c04de71621e47486f7aa2634fd or later. Implement proper authorization checks when referencing ClusterLogForwarder or OpenTelemetryCollector resources across namespaces. Monitor for suspicious activity related to ManagedClusterAddOn configurations and Secret copying.

Sources

  • National Vulnerability Database (NVD)
  • Red Hat Security Advisory
  • Bugzilla
  • GitHub