This vulnerability exists in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2.11. A privileged user, specifically a namespace administrator who can create Channel and Subscription resources, can exploit the flaw by manipulating the Channel.Spec.SecretRef.Namespace field. This manipulation causes the system to fetch and copy Secret contents from other namespaces into the attacker's namespace, resulting in unauthorized disclosure of sensitive information. The root cause is improper validation of tenant-controlled namespace references when fetching Secret data. The vulnerability is tracked as CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS v3.1 score of 7.7 (High).

An attacker with namespace administrator privileges can exfiltrate sensitive Secret data from other namespaces within the Kubernetes cluster. This leads to a confidentiality breach but does not affect integrity or availability. The vulnerability enables horizontal privilege escalation within the cluster by bypassing access controls on Secret resources.

According to the Red Hat advisory, no mitigation is currently available that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's official channels for updates and advisories regarding patches or mitigations. Until a fix is provided, restricting namespace administrator privileges and limiting the ability to create Channel and Subscription resources to fully trusted users is recommended.