This vulnerability affects the Submariner operator component of Red Hat Advanced Cluster Management for Kubernetes 2. It exposes a long-lived broker service account bearer token in cleartext within the Submariner Custom Resource specification. Attackers with local access to the cluster's etcd database or the ability to execute kubectl get commands can retrieve this token. The token grants full control over the Submariner mesh network, enabling unauthorized management of network resources such as endpoints and secrets. The vulnerability arises from storing sensitive information unencrypted in a Kubernetes Custom Resource, violating confidentiality principles (CWE-312). The CVSS v3.1 score is 7.8 (High), with local attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory recommends mitigating the risk by enforcing strict Kubernetes Role-Based Access Control (RBAC) policies to restrict read access to Submariner Custom Resources only to authorized entities. No official patch or fix has been announced as of the advisory date.

If exploited, an attacker with read access to the cluster's etcd database or the ability to run kubectl get commands can obtain a long-lived bearer token that grants full control over the Submariner mesh network. This includes unauthorized management of network endpoints and secrets, potentially compromising the confidentiality, integrity, and availability of network resources within the Kubernetes cluster.

No official patch or fix is currently confirmed for this vulnerability. The vendor advisory recommends strictly controlling access to Submariner Custom Resources by implementing Kubernetes Role-Based Access Control (RBAC) policies. Read access to these resources should be limited only to authorized administrators and components that explicitly require it. Review and enforce least privilege principles on RBAC configurations to reduce the risk of unauthorized disclosure of the broker service account bearer token stored in cleartext within the Custom Resource specification.