A critical security flaw in Red Hat Advanced Cluster Management for Kubernetes 2 allows authenticated tenants to bypass security controls and deploy arbitrary resources cluster-wide.

This is a confused deputy vulnerability (CWE-441) where the HelmRelease controller processes templates using elevated ServiceAccount privileges without sufficient validation. An attacker with low-level access (PR:L) to create HelmRelease custom resources can abuse this mechanism to perform actions beyond their intended authorization level.

Successful exploitation allows a tenant to escape their restricted environment and execute arbitrary operations across the entire cluster. This poses a catastrophic risk to data confidentiality and system availability, as demonstrated by the 9.9 CVSS score. Organizations face risks of total system takeover and unauthorized access to sensitive data managed by the orchestrator.

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2 to the latest patched version immediately.

Proactive Monitoring: Review logs for unusual HelmRelease deployments or unauthorized creation of custom resources by standard tenant accounts.

Compensating Controls: Apply strict Role-Based Access Control (RBAC) to limit the ability of tenants to create or modify HelmRelease custom resources until the update can be applied.

Public Exploit Available: Unknown

The severity of this issue necessitates an urgent review of current tenant permissions and the immediate application of vendor updates. Organizations should ensure that the HelmRelease controller is not processing untrusted input from unauthorized sources.