A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2 involves the submariner-k8s-broker-cluster Role having overly broad permissions. This Role, assigned to joined clusters, allows any compromised cluster to modify endpoint configurations for all other clusters within the broker namespace. As a result, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the cluster mesh. The vulnerability is rated critical with a CVSS 3.1 score of 9.9, reflecting network attack vector, low complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability. Red Hat's advisory states that no suitable mitigation or fix currently meets their criteria for ease of use, applicability, or stability.

A compromised cluster can exploit excessive permissions to alter network configurations of other clusters by overwriting endpoint information. This allows an attacker to redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack that compromises confidentiality, integrity, and availability of communications across the entire cluster mesh.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor Red Hat's advisory for updates and consider engaging Red Hat Technical Account Managers if available. No direct mitigation actions are recommended by Red Hat at this time.