This vulnerability arises from the addon-manager pod's ClusterRole in Red Hat Advanced Cluster Management for Kubernetes 2 having excessive permissions. Specifically, a compromised addon-manager pod can read and modify any secret across all namespaces and approve arbitrary CSRs. These capabilities allow an attacker to gain unauthorized access to sensitive information and escalate privileges within the cluster. The issue is classified as improper privilege management (CWE-269). Red Hat has rated this vulnerability as Important with a CVSS v3.1 base score of 8.7, reflecting high confidentiality and integrity impacts with no availability impact. Currently, there is no available fix or mitigation that meets Red Hat's standards for ease of use, applicability, or stability.

A compromised addon-manager pod can gain extensive cluster-wide privileges, including reading and modifying all secrets across namespaces and approving arbitrary CSRs. This can lead to significant unauthorized information disclosure and privilege escalation within the Kubernetes cluster, potentially allowing attackers to assume higher privileges and control cluster resources.

As per the Red Hat advisory, no mitigation or fix currently meets the criteria for deployment and stability. Users should monitor the Red Hat advisory for updates. Customers with a Technical Account Manager (TAM) can review this CVE directly with their TAM for tailored guidance. Until an official fix or mitigation is released, organizations should consider limiting exposure of the addon-manager pod and monitor for suspicious activity related to secret access and CSR approvals.