This vulnerability arises from the cluster-curator-controller's CreateJob() function failing to validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. A tenant with create or update permissions on ClusterCurator resources can inject a malicious Job specification that runs with the controller's elevated privileges. This leads to arbitrary code execution and privilege escalation, potentially exposing cluster-wide secrets and access to managed clusters. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code, 'Code Injection'). The CVSS v3.1 base score is 9.9 (critical), reflecting network attack vector, low complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability. The vendor advisory recommends implementing strict RBAC policies to limit permissions on ClusterCurator resources to trusted administrators. No official fix or patch is currently confirmed in the advisory.

Successful exploitation allows an attacker with limited privileges (create/update on ClusterCurator resources) to execute arbitrary code with the cluster-curator-controller's elevated privileges. This can lead to privilege escalation, unauthorized access to cluster-wide secrets, and potential full control over managed Kubernetes clusters. The vulnerability affects confidentiality, integrity, and availability of the Kubernetes environment.

Red Hat advises implementing strict Role-Based Access Control (RBAC) policies to restrict create and update permissions on clustercurators.cluster.open-cluster-management.io resources to trusted administrators only. This limits the ability of less privileged tenants to exploit the vulnerability. No official patch or fix is currently confirmed; therefore, applying RBAC restrictions is the primary mitigation until a fix is released. Monitor the Red Hat advisory page for updates on patch availability.