A vulnerability exists in the acm-search-v2-rhel9 component of Red Hat Advanced Cluster Management for Kubernetes 2.11. An attacker with high privileges on the hub cluster, specifically patch access to the Search Custom Resource, can manipulate the Collector.ImageOverride field to deploy arbitrary container images to all managed clusters. This leads to remote code execution (RCE) and potential secret exfiltration across the managed fleet. The flaw arises from the propagation of the Collector.ImageOverride field to all managed clusters, allowing a highly privileged user to replace the collector image fleet-wide.

The vulnerability enables remote code execution across all managed Kubernetes clusters controlled by the hub cluster. An attacker with patch access to the Search Custom Resource can execute arbitrary commands and potentially exfiltrate sensitive information from all managed clusters. This compromises confidentiality, integrity, and availability to a high degree, as reflected by the CVSS score of 9.0.

Red Hat advises restricting patch access to the Search Custom Resource (CR) strictly to trusted and authorized hub administrators. This limits the ability of unauthorized users to modify the Collector.ImageOverride field and deploy arbitrary container images across the managed clusters. No official patch or update is explicitly mentioned in the advisory; therefore, access control is the primary mitigation.