This vulnerability involves the GitOpsCluster controller in Red Hat Advanced Cluster Management's multicloud-integrations component. An authenticated tenant can exploit the flaw to cause the controller to write spoke cluster bearer tokens to an attacker-chosen namespace, bypassing existing security guards and ArgoCD AppProject constraints. This results in unauthorized disclosure of sensitive tokens and privilege escalation. The issue is classified as CWE-441 (Unintended Proxy or Intermediary, 'Confused Deputy'). The CVSS v3.1 base score is 9.6 (critical), reflecting network attack vector, low complexity, low privileges required, no user interaction, changed scope, and high confidentiality and integrity impacts.

An authenticated tenant can exfiltrate sensitive spoke cluster bearer tokens by redirecting them to a namespace under their control. This leads to disclosure of critical information and bypass of security policies within ArgoCD AppProjects, enabling privilege escalation and circumvention of access controls. The vulnerability compromises confidentiality and integrity but does not impact availability.

Currently, no mitigation or patch is available that meets Red Hat Product Security criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is provided, restricting tenant privileges and carefully controlling access to the GitOpsCluster controller may reduce risk, but no official mitigation is confirmed.