This vulnerability in the Submariner operator of Red Hat Advanced Cluster Management for Kubernetes 2.17 allows exposure of a long-lived broker ServiceAccount bearer token stored in cleartext within the Submariner Custom Resource specification. An attacker with access to the cluster's etcd database or read permissions on the Submariner CRs (e.g., via kubectl get) can retrieve this token. Possession of the token enables full control over the mesh network, including unauthorized management of network endpoints and secrets. The root cause is improper privilege management and insufficient Role-Based Access Control (RBAC) restrictions on the Submariner CRs. The vulnerability has a CVSS 3.1 base score of 5.8 (medium severity) with network attack vector, high attack complexity, high privileges required, no user interaction, and changed scope. Red Hat has released security advisories and updated Submariner v0.24 images addressing this issue. Mitigation involves strict RBAC policies limiting read access to Submariner CRs to authorized administrators and components only.

An attacker with read access to the Kubernetes cluster's etcd database or the ability to execute kubectl get commands on Submariner Custom Resources can obtain a long-lived broker ServiceAccount bearer token. This token grants full control over the Submariner mesh network, allowing unauthorized management of network resources such as endpoints and secrets. The vulnerability does not impact confidentiality but has a high integrity impact and no availability impact. The scope of the vulnerability is changed, meaning privileges can be escalated or access extended beyond the original scope.

Red Hat advises controlling access to Submariner Custom Resources (CRs) strictly by implementing Kubernetes Role-Based Access Control (RBAC) policies that limit read access to only authorized administrators and components that require it. This reduces the risk of unauthorized disclosure of the broker ServiceAccount bearer token stored in cleartext within the CR specification. Additionally, Red Hat has released updated Submariner v0.24 images with security fixes. Users should upgrade to these fixed versions as soon as possible. Review and apply least privilege principles to RBAC configurations for resources containing sensitive information. No other immediate action is required beyond applying these mitigations and updates.