This vulnerability arises from improper control over dynamically-determined object attributes in the search-v2-operator component. A user with patch managedclusteraddons permission can exploit this flaw by injecting arbitrary Helm values through the addon.open-cluster-management.io/values annotation on a ManagedClusterAddOn resource. This injection can override critical settings, resulting in container image replacement on the managed cluster, which may lead to privilege escalation and arbitrary code execution. Red Hat has published an advisory but has not provided a patch or mitigation that meets their criteria for ease of use, applicability, or stability.

An attacker with specific administrative permissions can manipulate configuration data to replace container images on the managed cluster. This compromises the integrity of the cluster, enabling privilege escalation and arbitrary code execution. The vulnerability impacts confidentiality and integrity with no availability impact. The CVSS v3.1 base score is 8.5 (high severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and changed scope.

Red Hat currently does not offer a mitigation or official fix that meets their standards for deployment and stability. Users should monitor Red Hat's advisory for updates. Until a fix or mitigation is available, restricting administrative permissions on managed clusters to trusted users is advisable to reduce risk.