This vulnerability arises from the acm-operator-bundle's build process downloading and running an unverified script from a remote source. Because the script is not authenticated, an attacker could replace or tamper with it to execute malicious code with elevated privileges. This malicious code could access sensitive build environment credentials, including GitHub access tokens and registry passwords, potentially leading to unauthorized access and compromise of the resulting operator bundle. The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and has a CVSS v3.1 score of 8.0 (high severity) with network attack vector, high attack complexity, and high privileges required. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, and stability.

Exploitation of this vulnerability could allow a remote attacker to inject malicious code into the build process, gaining unauthorized access to sensitive credentials and build resources. This could compromise the integrity of the operator bundle produced by the build, potentially leading to widespread supply chain compromise. The impact includes high confidentiality, integrity, and availability risks as indicated by the CVSS score and vector.

Currently, Red Hat states that no mitigation is available or that existing options do not meet their criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Until an official fix or mitigation is released, caution should be exercised with the build process, and access to build environments should be tightly controlled. Customers with Red Hat Technical Account Managers (TAM) may consult them for guidance. Applying updates to newer versions of Red Hat Advanced Cluster Management for Kubernetes when they become available is recommended.