This vulnerability arises from the misuse of elevated privileges in OpenShift Container Platform's build process. Specifically, the git-clone container is executed with privileged security context during build initialization, granting unrestricted node access. An attacker with developer-level permissions can craft a .gitconfig file that executes arbitrary commands during the git cloning process, enabling command execution on the worker node. This can lead to privilege escalation and node compromise. Red Hat has released security advisories and updated container images for OpenShift Container Platform 4.15 and 4.17 to address this issue. Users are advised to upgrade to these fixed versions to remediate the vulnerability.

An attacker with developer-level access can exploit this vulnerability to execute arbitrary commands on the worker node, potentially leading to full node compromise. This elevates the attacker's privileges beyond their intended scope, impacting confidentiality, integrity, and availability of the affected system. The CVSS v3.1 score is 9.9 (critical), reflecting the high severity and ease of exploitation over the network without user interaction.

Red Hat has released fixed container images and packages for OpenShift Container Platform versions 4.15.33 and 4.17.0 that address this vulnerability. Users should upgrade their OpenShift clusters to these or later versions as soon as they become available in their release channels. The vendor manages remediation for these releases, and detailed upgrade instructions are provided in the Red Hat advisories and OpenShift documentation. No alternative mitigations or workarounds are indicated in the vendor advisory.