The vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 involves the insights-client component's ServiceAccount being bound to a ClusterRole with cluster-wide permissions to get, list, and watch all Secrets. However, the component only needs access to a single Secret (openshift-config/pull-secret). This over-privileged access creates a privilege amplification vector, enabling an attacker who compromises the insights-client pod or its ServiceAccount token to gain read access to all Secrets in the hub cluster, potentially exposing sensitive credentials. The issue is classified as CWE-250 (Execution with Unnecessary Privileges) and has a CVSS v3.1 score of 6.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity or availability impact.

An attacker who compromises the insights-client pod or its ServiceAccount token can read all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials. This could lead to unauthorized disclosure of sensitive information but does not directly impact integrity or availability. The scope of the vulnerability is changed due to the cluster-wide permissions granted beyond what is necessary.

The vendor recommends restricting the insights-client ClusterRole to the minimum required permissions. Specifically, replace the cluster-wide secrets get/list/watch permissions with a namespaced Role that grants get access only to the specific Secret openshift-config/pull-secret in the openshift-config namespace. This reduces the attack surface by adhering to the principle of least privilege. No official patch or fix release status is provided in the advisory; therefore, users should apply the recommended RBAC configuration changes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.