The vulnerability in StackRox/RHACS Central's Auth M2M token exchange is due to unanchored regular expressions used for matching claim values in role mappings. This permissive matching allows attackers possessing a valid OIDC token with a claim value that is a superstring of a configured pattern to obtain unauthorized roles, resulting in privilege escalation. The issue stems from substring matching rather than exact matching of claim values. The CVSS v3.1 score is 6.8 (medium severity) with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact. The vendor advisory recommends anchoring regular expressions with delimiters such as ^ and $ to enforce exact matching and prevent exploitation. No official patch or fix has been published yet, and administrators must manually update configurations and reload or restart services.

An attacker with a valid OIDC token can exploit the unanchored regular expression matching to gain unauthorized roles, leading to privilege escalation within Red Hat Advanced Cluster Security 4. This compromises confidentiality and integrity by allowing access beyond intended permissions. Availability is not impacted. The attack requires the attacker to have low privileges and access to a trusted identity provider to obtain a suitable token. The flaw depends on administrator-configured M2M role mappings using unanchored patterns.

No official patch or fix is currently confirmed. Administrators should immediately review and update their Auth M2M role mappings in StackRox/RHACS Central to ensure that all `valueExpression` regular expressions are properly anchored with ^ and $ delimiters to enforce exact matching of claim values. After updating, reload the configuration or restart the Central service for changes to take effect. This configuration change mitigates the vulnerability by preventing substring matching that leads to unauthorized role assignments.