This vulnerability exists in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes 2. A user who has permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. By doing so, an attacker can run a controlled container image with cluster-admin privileges on the managed (spoke) cluster, leading to arbitrary code execution and privilege escalation. The flaw is due to improper input validation allowing the override of the container image via annotations. The attack vector is network-based, requires low privileges (namespace-level annotate permission), and no user interaction. The vulnerability impacts confidentiality, integrity, and availability with high severity (CVSS 8.8).

An attacker with namespace-level annotate permissions on the ManagedClusterAddOn resource can execute arbitrary code with cluster-admin privileges on the managed cluster. This leads to full control over the cluster, including privilege escalation and potential compromise of cluster resources. The vulnerability affects confidentiality, integrity, and availability of the managed Kubernetes cluster. No known exploits are reported in the wild at this time.

There is no official patch or fix currently confirmed by Red Hat. To mitigate this vulnerability, restrict the ability to annotate ManagedClusterAddOn resources within the hub cluster. Ensure that only trusted administrators have namespace-level annotate permissions on these resources. Regularly audit and review permissions related to ManagedClusterAddOn to prevent unauthorized modifications. These permission changes persist across service restarts or reloads. Monitor Red Hat's advisory for updates on official fixes.