The vulnerability arises from improper resource locking in the flightctl device-render worker of Red Hat Advanced Cluster Management for Kubernetes 2. The function configureRepoHTTPSClient() builds a per-repository TLS configuration and installs it into a global go-git client.Protocols map. Because multiple tenants' git operations run concurrently in a shared goroutine pool, the last tenant's TLS settings overwrite others, causing a race condition. This leads to leakage of TLS settings such as InsecureSkipVerify or mTLS client credentials between tenants. Exploitation requires a multi-tenant environment, fleet administrator privileges to create Repository resources with custom TLS settings, and control of an external git server to capture leaked credentials. Single-tenant deployments are not meaningfully impacted. The vulnerability is tracked as CWE-413 (Improper Resource Locking).

Confidentiality impact is high due to potential leakage of sensitive TLS client certificates and InsecureSkipVerify settings between tenants, which could allow an attacker to intercept or manipulate git operations of other tenants. Integrity impact is low, and availability is unaffected. Exploitation requires high privileges and specific conditions, limiting the scope to multi-tenant deployments with fleet administrator access.

There is no application-level workaround that fully eliminates this race condition without a code fix. Deployment-level mitigations to reduce exposure include: (1) Avoid using mTLS client certificates in tenant Repository resources to prevent leakage of private key material. (2) Avoid setting skipServerVerification to true in any Repository resource to prevent propagation of InsecureSkipVerify=true to other tenants. These mitigations reduce risk but do not fully resolve the underlying race condition. Monitor Red Hat advisories for official patches.