CVE-2025-2843: Incorrect Privilege Assignment in rhobs observability-operator
A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.
AI Analysis
Technical Summary
The vulnerability exists because the Observability Operator creates a ServiceAccount with ClusterRole permissions upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This design flaw enables a Kubernetes account with only namespaced-level roles to escalate privileges by creating a MonitorStack and impersonating the ServiceAccount created by the operator. The escalation results in cluster-level permissions, which can lead to privilege escalation and other security issues. Red Hat rates this vulnerability as important with a CVSS v3.1 score of 8.8 (high severity).
Potential Impact
An attacker with limited namespace-level permissions can escalate their privileges to cluster-level by exploiting this vulnerability. This could lead to unauthorized access to cluster-wide resources and administrative functions, significantly increasing the attack surface and risk to the Kubernetes cluster's security and integrity.
Mitigation Recommendations
Currently, no mitigation is available for this vulnerability. Users should monitor Red Hat advisories for updates and apply patches once they become available. Until a fix is released, restricting the ability to create MonitorStack resources to trusted users may reduce risk, but no official workaround is provided by the vendor.
CVE-2025-2843: Incorrect Privilege Assignment in rhobs observability-operator
Description
A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/rhobs/observability-operatorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists because the Observability Operator creates a ServiceAccount with ClusterRole permissions upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This design flaw enables a Kubernetes account with only namespaced-level roles to escalate privileges by creating a MonitorStack and impersonating the ServiceAccount created by the operator. The escalation results in cluster-level permissions, which can lead to privilege escalation and other security issues. Red Hat rates this vulnerability as important with a CVSS v3.1 score of 8.8 (high severity).
Potential Impact
An attacker with limited namespace-level permissions can escalate their privileges to cluster-level by exploiting this vulnerability. This could lead to unauthorized access to cluster-wide resources and administrative functions, significantly increasing the attack surface and risk to the Kubernetes cluster's security and integrity.
Mitigation Recommendations
Currently, no mitigation is available for this vulnerability. Users should monitor Red Hat advisories for updates and apply patches once they become available. Until a fix is released, restricting the ability to create MonitorStack resources to trusted users may reduce risk, but no official workaround is provided by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2025-03-27T03:15:47.915Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2025:21146","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2025-2843","vendor":"Red Hat"}]
Threat ID: 6914c133f490e7dc3cc5b766
Added to database: 11/12/2025, 17:17:39 UTC
Last enriched: 08/06/2026, 16:18:55 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 410
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.