A critical privilege assignment vulnerability in Red Hat OpenShift AI allows authenticated attackers with ServiceAccount access to potentially obtain full cluster administrator privileges.

This vulnerability involves an Incorrect Privilege Assignment (CWE-266) within the maas-api and maas-controller ServiceAccounts. The flaw requires high privileges to exploit, as it leverages existing service accounts to perform unauthorized actions across the cluster.

The vulnerability carries a CVSS score of 7.9, reflecting its high severity regarding potential impact on confidentiality and integrity. Successful exploitation could lead to full cluster administrator access, resulting in the unauthorized disclosure of sensitive information, such as secrets stored across the cluster, and total compromise of the container orchestration environment.

Immediate Action: Monitor vendor security bulletins for the release of a patch and apply it immediately upon availability.

Proactive Monitoring: Review cluster access logs for anomalous behavior originating from the maas-api and maas-controller service accounts, specifically looking for unauthorized secret access or unexpected API calls.

Compensating Controls: Implement strict network policies and RBAC hardening to limit the blast radius of compromised service accounts until a formal patch is applied.

Public Exploit Available: No

Given the potential for complete cluster compromise, administrators should treat this vulnerability with high urgency. While no patch is currently identified, maintaining robust audit logging and applying the principle of least privilege to all cluster service accounts is essential to mitigate the risk of exploitation.