The vulnerability arises from insufficient verification of data authenticity in RHACS when processing Kubernetes Deployments. Specifically, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with deployment creation permissions can set this label to "null", causing ACS to treat the workload as having empty UID, name, labels, and default namespace. This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central, and breaks violation reporting and compliance correlation for the affected deployment. Red Hat is aware of this issue and plans to release updates according to the RHACS support lifecycle. There is no complete mitigation other than installing the update once available.

An attacker with permission to create Kubernetes Deployments can evade deploy-time policy visibility and enforcement for workloads by exploiting this flaw. This reduces the integrity of ACS security reporting and compliance correlation, potentially allowing unauthorized or non-compliant deployments to go undetected. There is no known active exploitation outside of coordinated testing.

Currently, there is no complete mitigation other than installing the update once it is released by Red Hat. Users should monitor Red Hat advisories for the availability of a fix and apply updates promptly when available.