This vulnerability arises from the Channel controller's auto-generated Role granting excessive permissions to managed-cluster agents. A compromised agent can exploit these permissions to read all Secrets and ConfigMaps in any Channel namespace on the hub, potentially exposing sensitive credentials belonging to other tenants. The flaw is classified under CWE-269 (Improper Privilege Management) and has a CVSS v3.1 score of 7.7 (High severity) with network attack vector, low complexity, and low privileges required. Red Hat has acknowledged the issue but currently does not offer a remediation that meets their standards for deployment and stability.

An attacker controlling a managed-cluster agent can access sensitive information across tenants by reading Secrets and ConfigMaps in any Channel namespace on the hub. This unauthorized access can lead to exposure of credentials for Git and Helm repositories, increasing the risk of information disclosure. The integrity and availability of the system are not impacted, but confidentiality is severely compromised.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat's advisory for updates on official fixes or recommended mitigations. Until a fix is provided, caution should be exercised regarding agent trust and deployment scope.