The vulnerability CVE-2024-5042 in the Submariner project arises from unnecessary RBAC permissions that grant excessive privileges. A privileged attacker can exploit this to execute a malicious container on a node, which may lead to theft of service account tokens and compromise of additional nodes within the cluster. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. Red Hat OpenShift Data Foundation has released security updates that include fixes for this vulnerability.

An attacker with privileged access can leverage this vulnerability to run malicious containers on nodes, potentially stealing service account tokens. This can lead to further compromise of other nodes and possibly the entire cluster, affecting the integrity and confidentiality of the environment. The vulnerability does not impact availability directly. The CVSS score of 6.6 reflects a medium severity level.

Red Hat has released updated packages for Red Hat OpenShift Data Foundation that address CVE-2024-5042. Users are advised to apply these security updates as soon as possible. Before applying the update, ensure all previously released errata relevant to the system have been applied. Refer to the official Red Hat advisories RHSA-2024:4591 and RHSA-2026:6503 for detailed remediation instructions and updated images. No additional mitigations are specified beyond applying the official patches.