The vulnerability in Red Hat multicluster engine for Kubernetes arises from the build process of the mce-operator-bundle, which fetches and executes scripts from a remote repository without performing integrity verification such as commit pinning or signature checks. This insufficient trust in a component allows a malicious actor with write access to the remote repository to inject arbitrary code, leading to a compromised build process and the potential distribution of malicious software. The CVSS v3.1 score is 7.7 (high severity) with network attack vector, high attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality and integrity impact but no availability impact. Red Hat has released updated images and security advisories for version 2.17.2 and later, but no direct patch for the vulnerable build process is explicitly stated.

An attacker with write access to the remote repository used in the build process can inject arbitrary code that will be executed during the build of the mce-operator-bundle. This compromises the integrity of the build process and can lead to the distribution of malicious software, affecting confidentiality and integrity of the affected systems. There is no indication of availability impact or active exploitation in the wild.

Red Hat has released updated images and security advisories for multicluster engine for Kubernetes starting with version 2.17.2 that include security fixes. Users should upgrade to these updated versions as per Red Hat's documentation. No direct patch for the build process flaw is provided, so following Red Hat's recommended upgrade path and using the updated images is the advised mitigation. Patch status is not explicitly confirmed for the build process itself; check the vendor advisory for the latest remediation guidance.