This critical vulnerability in Red Hat Multicluster Engine for Kubernetes enables a privileged service account to perform privilege escalation and gain unauthorized administrative access to the hub cluster.

The managedcluster-import-controller fails to properly validate Certificate Signing Requests (CSRs) by neglecting to inspect signer names or decode PEM-encoded x509 data. This allows an authenticated user with high privileges on a spoke cluster to submit malicious CSRs that the hub cluster incorrectly approves.

With a CVSS score of 9.1, this vulnerability poses a severe risk to the integrity of the hub-and-spoke management architecture. An attacker successfully exploiting this flaw can obtain administrative credentials for the hub cluster, effectively seizing control of the entire multicluster environment and all associated managed workloads.

Immediate Action: Update Red Hat Multicluster Engine for Kubernetes to the latest version immediately to ensure CSR validation logic is correctly implemented.

Proactive Monitoring: Audit logs for suspicious Certificate Signing Request approvals and review the integrity of existing cluster service accounts.

Compensating Controls: Restrict the ability of spoke cluster service accounts to submit CSRs until the patch can be deployed across the environment.

Public Exploit Available: No

This vulnerability represents a significant threat to the centralized management plane. Organizations should prioritize the deployment of the vendor-provided update to prevent potential administrative credential theft and subsequent unauthorized access to the global hub.