CVE-2025-11393 is a vulnerability in the runtimes-inventory-rhel8-operator component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0.0. The vulnerability arises from an internal proxy component that is incorrectly configured, causing it to attach the cluster's main administrative credentials to any command it receives rather than limiting credentials to specific reports. This misconfiguration allows a standard user within the cluster to send unauthorized commands to the management platform, effectively gaining full administrative privileges over the cluster. The vulnerability has a CVSS 3.1 base score of 8.7 (high severity) with an attack vector of adjacent network, low attack complexity, low privileges required, no user interaction, and a changed scope. Red Hat has issued updated RHEL 9 container images containing backported patches to fix this issue and recommends users upgrade and rebuild dependent container images. As a temporary mitigation, disabling the proxy server by setting INSIGHTS_ENABLED to false is possible, though it causes a crash loop in the Insights container, which is harmless. No active exploitation has been reported. The vulnerability is tracked under Red Hat advisory RHSA-2025:23236.

An attacker with standard user privileges within the cluster can exploit this vulnerability to execute commands with the full permissions of the cluster administrator on the Red Hat management platform. This could lead to unauthorized changes to the cluster's configuration or status, potentially compromising cluster integrity and control. The vulnerability does not impact availability but has high confidentiality and integrity impacts.

Red Hat has released updated RHEL 9 container images with backported patches that fix this vulnerability. Users of Red Hat Insights for Runtimes on RHEL 8 container images are advised to upgrade to these updated images and rebuild all dependent container images. As a temporary mitigation, the proxy server can be disabled by adding the environment variable INSIGHTS_ENABLED set to "false" in the Cryostat or JWS subscription YAML. This disables the affected proxy but causes a harmless crash loop in the Insights container. Users should apply all previously released errata relevant to their system before updating. Refer to Red Hat advisory RHSA-2025:23236 for detailed update instructions.