This vulnerability affects the provider-credential-controller in Red Hat Multicluster Engine for Kubernetes. An attacker with specific permissions (secrets:create) on any namespace of the hub cluster and knowledge of a previous credential value can exploit an authorization bypass by manipulating copiedFrom labels. This allows the attacker to intercept rotated provider credentials by coercing the controller to propagate credentials to an attacker-controlled Secret, resulting in unauthorized information disclosure of sensitive credentials. The flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). Red Hat has published an advisory but currently does not offer an official fix or mitigation that meets their product security criteria.

The vulnerability allows an attacker with limited permissions and prior credential knowledge to bypass authorization controls and gain access to sensitive provider credentials during rotation. This results in unauthorized disclosure of confidential information. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, and user interaction needed. The impact is limited to confidentiality; integrity and availability are not affected.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates on fixes or mitigations. Until an official fix is released, restricting secrets:create permissions and limiting knowledge of prior credentials may reduce risk but are not guaranteed mitigations.