The vulnerability exists in the clusterclaims-controller of Red Hat Multicluster Engine for Kubernetes, where a tenant with create and delete permissions on ClusterClaim resources can exploit a missing ownership check on the spec.namespace field. This flaw enables the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, resulting in a denial of service condition. The issue stems from client-side enforcement of server-side security, specifically CWE-602, where client-side validation is bypassed, allowing unauthorized deletion of critical cluster resources. The CVSS v3.1 score is 7.7 (high severity) with network attack vector, low complexity, low privileges required, no user interaction, and a changed scope. Red Hat has not provided a patch or effective mitigation at this time.

Exploitation of this vulnerability allows an attacker with standard permissions on ClusterClaim resources to delete any ManagedCluster, including critical clusters such as the hub's local-cluster or other tenants' clusters. This can cause denial of service by disrupting cluster availability. There is no impact on confidentiality or integrity, but availability is severely affected.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix or mitigation is provided, restricting permissions on ClusterClaim resources and limiting tenant capabilities may reduce risk, but no official mitigation is confirmed.