The vulnerability exists in the governance-policy-addon-controller of Red Hat Advanced Cluster Management for Kubernetes. An attacker with permissions to annotate the ManagedClusterAddOn resource can override the governance-policy container image. This flaw enables the attacker to run a controlled container image with cluster-admin privileges on the managed cluster, resulting in arbitrary code execution and privilege escalation. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The issue stems from improper input validation allowing container image override via resource annotations.

An attacker with namespace-level annotate permissions on the ManagedClusterAddOn resource can execute arbitrary code with cluster-admin privileges on the managed cluster. This leads to full compromise of the managed Kubernetes cluster, including privilege escalation and bypassing image security controls. The vulnerability impacts confidentiality, integrity, and availability of the cluster environment.

Red Hat advises restricting annotate permissions on ManagedClusterAddOn resources to trusted administrators only. Regularly review and audit these permissions to prevent unauthorized modifications. These permission changes persist across service restarts. Red Hat has released security updates in later versions (e.g., 2.17.1) that include fixes and updated container images addressing this and other vulnerabilities. Users should upgrade to the fixed versions as per Red Hat advisories and apply all relevant errata.