This vulnerability arises from insufficient validation of container image paths in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.17. An attacker with cluster-admin privileges or equivalent can patch the Submariner Custom Resource to deploy a malicious container image. Because the image path is not validated, this can result in arbitrary code execution with elevated privileges on all cluster nodes, including control-plane nodes. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and scope change with low confidentiality and integrity impact. Red Hat has issued an important security advisory and released updated Submariner v0.24 images containing security fixes and container updates to mitigate this issue.

An attacker with cluster-admin or equivalent permissions can exploit this vulnerability to execute arbitrary privileged code across all nodes in the Kubernetes cluster, including control-plane nodes. This can compromise the integrity and confidentiality of the cluster environment. The vulnerability requires high privileges and network access, and no user interaction is needed. The impact is rated as medium severity with low confidentiality and integrity impact and no availability impact.

Red Hat has released updated Submariner v0.24 images that include security fixes for this vulnerability. Users should upgrade to these fixed versions as soon as possible. Additionally, to mitigate the risk, restrict access to cluster-admin roles and tightly control permissions for users or service accounts that can modify Submariner Custom Resources. Ensure that only trusted and authorized personnel can patch Submariner CRs to prevent deployment of malicious images.