A vulnerability exists in the acm-search-v2-rhel9 component of Red Hat Advanced Cluster Management for Kubernetes 2, where a highly privileged user with patch access to the Search Custom Resource (CR) on the hub cluster can manipulate the Collector.ImageOverride field. This manipulation allows deployment of arbitrary container images to all managed clusters, resulting in remote code execution and possible secret exfiltration across the entire managed fleet. The vulnerability is due to the inclusion of functionality from an untrusted control sphere, specifically the propagation of the Collector.ImageOverride field. The CVSS v3.1 base score is 9.0 (critical) with network attack vector, low complexity, high privileges required, no user interaction, changed scope, and high confidentiality and integrity impact with low availability impact. The vendor advisory recommends restricting patch access to the Search CR to trusted administrators as a mitigation. No patch or official fix status is currently provided in the advisory.

An attacker with administrative privileges and patch access to the Search CR on the hub cluster can execute arbitrary container images across all managed clusters, enabling remote code execution and potential access to sensitive information fleet-wide. This compromises confidentiality, integrity, and availability to a high degree, with the ability to execute unauthorized code and exfiltrate secrets across the managed Kubernetes clusters.

The vendor advisory states that to mitigate this vulnerability, patch access to the Search Custom Resource (CR) should be restricted exclusively to trusted and authorized hub administrators. This limits the ability of unauthorized users to modify the Collector.ImageOverride field and deploy arbitrary container images. No official patch or fix has been confirmed yet; therefore, organizations should apply this access restriction as an immediate mitigation and monitor the vendor advisory for updates on patch availability.