The vulnerability exists in the clusterclaims-controller of Multicluster Engine (MCE) for Kubernetes, where an authenticated tenant can exploit the flaw by manipulating ClusterClaim labels. This manipulation enables the tenant to cause a cluster to join a ManagedClusterSet owned by another tenant, effectively bypassing tenant isolation controls. As a result, the attacker can inject policies and workloads into clusters of other tenants, potentially gaining control over their resources. The issue is classified as an unintended proxy or intermediary ('Confused Deputy') problem (CWE-441).

The vulnerability allows an authenticated tenant to escalate privileges across tenant boundaries by forcing unauthorized cluster joins to other tenants' ManagedClusterSets. This leads to a breach of tenant isolation, enabling injection of policies and workloads into victim clusters. The confidentiality impact is high, integrity impact is low, and availability is not affected. This could result in unauthorized access and control over resources belonging to other tenants.

Currently, there is no available mitigation that meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's advisory for updates on official fixes or recommended mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.