This vulnerability allows a tenant with permissions to create HelmRelease objects in Red Hat Advanced Cluster Management for Kubernetes 2 to exploit a flaw in the HelmRelease controller. By manipulating the secretRef.Namespace field, the attacker can cause the GetSecret() function to fetch sensitive credentials from Secrets in arbitrary namespaces. These credentials are then exfiltrated to an attacker-controlled Helm repository, leading to unauthorized exposure of sensitive information across the cluster. The issue is rated with a CVSS 3.1 score of 7.7 (high severity) and involves a confidentiality impact without affecting integrity or availability. Red Hat has not provided an official fix or mitigation that meets their product security criteria at this time.

The vulnerability results in the exposure of sensitive credentials from Secrets in any namespace within the Kubernetes cluster managed by Red Hat Advanced Cluster Management. This unauthorized information disclosure can compromise cluster security by leaking credentials to an attacker-controlled repository. There is no impact on integrity or availability, but confidentiality is highly impacted.

Currently, Red Hat has not released an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates. Until a fix is available, restricting HelmRelease create permissions to trusted tenants only and minimizing the number of users with such permissions may reduce risk. Consult Red Hat support or a Technical Account Manager for tailored guidance.