An authentication-related flaw in Red Hat Advanced Cluster Management and Multicluster Engine allows an attacker to escalate privileges to cluster-admin, granting full control over managed clusters.

This vulnerability is a confused deputy issue in the cluster-proxy service-proxy component. An authenticated hub principal can inject an Impersonate-Group header, allowing the attacker to escalate their privileges to cluster-admin across every managed cluster.

The CVSS score of 8.5 highlights the severe impact of this vulnerability, as it allows for the total compromise of Kubernetes clusters. An attacker with cluster-admin access can manipulate container workloads, access secrets, and exfiltrate sensitive data, leading to a complete breakdown of cluster isolation and security governance.

Immediate Action: Refer to the official Red Hat security advisory at the provided URL to identify the specific patched versions for your environment and update immediately.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious usage of the Impersonate-Group header or unexpected cluster-admin role assignments.

Compensating Controls: Implement strict Kubernetes RBAC policies and consider limiting the ability of hub principals to perform cross-cluster management tasks until the patch is applied.

Public Exploit Available: No.

Given the potential for complete cluster compromise, organizations using RHACM or MCE should treat this as a high-priority remediation task. Ensure all clusters are updated to the vendor-recommended version and verify that RBAC configurations are as restrictive as possible.