A critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 allows for cross-cluster resource injection and potential privilege escalation.

This is an improper access control vulnerability (CWE-284) where a remote attacker, having compromised a spoke cluster, uses attacker-controlled labels to influence resource injection. The attacker requires low privileges (PR:L) within a managed cluster to execute the attack, which then impacts the broader cluster environment.

The ability to inject unauthorized EndpointSlices and ServiceImports into critical system namespaces can lead to total compromise of the affected Kubernetes clusters. With a CVSS score of 9.9, this vulnerability presents a severe risk of unauthorized data access, privilege escalation, and complete loss of cluster integrity, potentially causing significant operational downtime and reputational damage.

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2 to the latest version provided by the vendor.

Proactive Monitoring: Monitor cluster audit logs for unexpected modifications to broker objects or unusual resource creation requests in critical namespaces.

Compensating Controls: Implement strict Kubernetes Network Policies to limit communication between clusters and restrict the ability of spoke clusters to interact with broker configurations.

Public Exploit Available: Unknown

Given the critical severity of this vulnerability and its potential to facilitate lateral movement across Kubernetes clusters, immediate patching is required. Administrators should prioritize applying the vendor-supplied updates and audit existing cluster configurations for signs of unauthorized resource injection.