This vulnerability exists in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2.11. A user on a managed cluster with limited privileges can exploit this flaw by creating a Subscription resource containing specific user-settable annotations. This bypasses intended security controls and escalates the user's privileges to cluster-admin level, allowing deployment of resources across multiple namespaces with the elevated permissions of the controller's Service Account. The vulnerability is classified as CWE-863 (Incorrect Authorization) and has a CVSS v3.1 base score of 9.9, indicating critical severity.

Successful exploitation grants an attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account. This can lead to unauthorized access and control over cluster resources, effectively resulting in full compromise of the managed Kubernetes cluster.

According to the Red Hat advisory, no effective mitigation is currently available that meets Red Hat Product Security criteria for ease of use, applicability, or stability. Users should monitor Red Hat's official channels for updates and patches addressing this vulnerability. Until a fix is released, restricting user privileges on managed clusters and limiting access to Subscription resource creation may reduce exposure but do not fully mitigate the risk.