The vulnerability exists in the cluster-proxy-addon of Red Hat Multicluster Engine for Kubernetes. An unauthenticated attacker with access to the user-facing route can bypass authentication and authorization checks by manipulating URL path segments. This allows the attacker to proxy requests to arbitrary services across any managed cluster, including internal services not normally exposed. The flaw is classified as Server-Side Request Forgery (CWE-918) and has a CVSS v3.1 base score of 9.3, reflecting its critical severity. The impact includes high confidentiality loss and low integrity impact, with no availability impact confirmed. The vulnerability does not allow remote code execution but can lead to unauthorized access and information disclosure.

An unauthenticated attacker can bypass authentication and authorization to proxy requests to arbitrary internal services across managed clusters. This can lead to unauthorized access to sensitive internal services and potential information disclosure. The integrity impact is low and availability is not affected. There is no confirmed remote code execution or denial of service impact.

No official fix or patch is currently confirmed. The vendor advisory recommends restricting network access to the user-facing route of the cluster-proxy-addon to trusted networks only. Implement firewall rules to limit inbound connections to the exposed port of the route, ensuring only authorized sources can reach it. This reduces the attack surface by preventing unauthenticated external access to the vulnerable proxy. Monitor the vendor advisory for updates regarding official patches or fixes.