A critical privilege escalation vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows authenticated users with limited privileges to achieve full cluster-admin access.

This flaw stems from improper capability checks within the Application Subscription controller, which fails to validate if an authenticated user possesses the subscription-admin role before processing Helm charts. This allows a user with namespace-scoped edit privileges to deploy malicious resources, including ClusterRoleBindings, which grant unauthorized administrative control over the cluster.

The vulnerability carries a CVSS score of 9.9, reflecting its ability to facilitate total compromise of the Kubernetes environment. Successful exploitation grants an attacker full administrative control, leading to unauthorized data access, potential lateral movement across the infrastructure, and total loss of system integrity.

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2 to the latest patched version provided by Red Hat.

Proactive Monitoring: Review audit logs for suspicious activity, specifically monitoring for the creation of unexpected ClusterRoleBindings or modifications to cluster-scoped resources by non-privileged accounts.

Compensating Controls: Strictly enforce Role-Based Access Control (RBAC) policies and limit the ability of users to create or modify Channel and Subscription resources within the hub namespace until the patch is applied.

Public Exploit Available: No

Given the critical severity and the potential for full cluster takeover, immediate action is required. Administrators must prioritize applying the vendor-supplied update to remediate the underlying logic error in the Subscription controller.