This vulnerability arises from the insights-client component in Red Hat Advanced Cluster Management for Kubernetes 2, where the ClusterID, controlled by a managed spoke cluster, is directly used in the Insights API URL path without proper validation or URL encoding. This improper limitation of a pathname to a restricted directory (CWE-22) allows a malicious spoke to inject unencoded data, potentially redirecting authenticated requests to unintended API endpoints on the hub cluster. The flaw can lead to unauthorized access or information disclosure. The CVSS 3.1 base score is 5.0 (medium), with network attack vector, low complexity, low privileges required, no user interaction, and scope changed. Red Hat has not provided an official fix or mitigation that meets their criteria, and the vulnerability remains open as of the advisory date.

A compromised managed cluster can exploit this flaw to redirect authenticated requests to unintended API endpoints on the hub cluster, potentially causing unauthorized access or information disclosure. The vulnerability affects confidentiality with low impact, does not affect integrity or availability, and requires low privileges with no user interaction. The scope of the impact is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Currently, Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates. No specific workaround or mitigation is available at this time.