The vulnerability in StackRox/RHACS Central's Auth M2M token exchange stems from unanchored regular expressions used for matching claim values in role mappings. Because the system performs substring matching rather than exact matching, an attacker possessing a valid OIDC token with a claim value that is a superstring of a configured pattern can escalate privileges by obtaining roles not intended for them. The CVSS v3.1 score is 6.8 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impacts. The vendor advisory recommends anchoring regular expressions (e.g., using ^ and $ delimiters) in the valueExpression to enforce exact matching and prevent unauthorized role assignments. Reloading or restarting the Central service may be necessary for changes to take effect. No official patch or fix release is currently confirmed in the advisory.

An attacker with a valid OIDC token can exploit the unanchored regular expressions in M2M role mappings to gain unauthorized access to roles beyond their intended permissions. This leads to privilege escalation within the Red Hat Advanced Cluster Security system, impacting confidentiality and integrity of the system. Availability is not affected. The attack requires an administrator to have configured M2M role mappings with unanchored regex patterns and the attacker to have some level of access to obtain a valid token from a trusted identity provider.

Administrators should review and update all Auth Machine-to-Machine (M2M) role mappings in StackRox/RHACS Central to ensure that the valueExpression regular expressions are properly anchored using start (^) and end ($) delimiters to enforce exact claim value matching. After updating the mappings, reload the configuration or restart the Central service to apply changes. No official patch or fix is currently confirmed; therefore, this configuration change is the recommended mitigation.