This vulnerability affects the mce-operator-bundle component of Red Hat Multicluster Engine for Kubernetes. The build process retrieves build logic from a mutable remote repository branch (master) without performing integrity verification like commit pinning or signature checks. Consequently, an attacker with write access to the remote repository can inject malicious code that will be executed during the build, compromising the integrity of the build output. This introduces a supply chain risk that could lead to the distribution of compromised software. The vulnerability is rated with a CVSS 3.1 score of 7.7 (high severity) by Red Hat, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, changed scope, and high confidentiality and integrity impacts. No patch or fix status is currently confirmed by Red Hat, and no runtime mitigations exist since the issue is in the build process itself.

The impact of this vulnerability is the potential compromise of the build process for the mce-operator-bundle, which could lead to the distribution of malicious software. This affects the integrity and confidentiality of the software supply chain for Red Hat Multicluster Engine for Kubernetes. If exploited, attackers could execute arbitrary code during the build, potentially injecting malware or other malicious functionality into the delivered software. There is no impact on availability reported. The vulnerability requires high privileges and network access to the remote repository, and no user interaction is needed.

According to the Red Hat advisory, this vulnerability resides in the build process fetching build logic from a mutable source without integrity verification. There are no direct runtime configuration or operational mitigations available to users for deployed products. Users should monitor Red Hat advisories for any forthcoming patches or official fixes. Until a fix is released, ensuring the security and integrity of the remote repository and restricting write access to trusted personnel is critical to mitigate risk. Customers with Red Hat Technical Account Managers (TAM) can consult them for further guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.