This critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows authenticated users to achieve cluster-wide privilege escalation and arbitrary code execution.

This is a confused deputy vulnerability (CWE-441) within the multicloud-integrations component. An authenticated tenant with permissions to create Applications on the hub cluster can exploit improper validation of the ocm-managed-cluster annotation to force ArgoCD on spoke clusters to synchronize malicious manifests.

Successful exploitation poses a severe risk to containerized environments, as it allows an attacker to bypass security boundaries and execute arbitrary code across managed clusters. Given the CVSS score of 9.9, this vulnerability represents an existential threat to the integrity and confidentiality of the entire managed Kubernetes fleet, potentially leading to total system compromise.

Immediate Action: Update the Red Hat Advanced Cluster Management for Kubernetes installation to the latest available version provided by the vendor.

Proactive Monitoring: Review access logs for the hub cluster to identify unauthorized or suspicious Application Custom Resource creation patterns.

Compensating Controls: Implement strict Kubernetes RBAC policies to limit the number of users capable of creating Application Custom Resources on the hub cluster.

Public Exploit Available: No (unknown)

Due to the critical severity and the potential for lateral movement across managed Kubernetes clusters, organizations should prioritize this update immediately. Restricting administrative access to the hub cluster is essential while pending the application of vendor-supplied patches.