A flaw in the multicluster-observability-addon of Red Hat Advanced Cluster Management for Kubernetes 2 allows remote attackers to access debug endpoints without authentication because of a misconfiguration in the underlying addon-framework library. This unauthorized access exposes sensitive operational information including goroutine, heap, and command-line details after completing a trivial TLS handshake. Although this vulnerability does not enable direct remote code execution, it increases the attack surface by providing attackers with reconnaissance data. The vulnerability affects the debug endpoints exposed on port 8443 and port 6060. Red Hat recommends restricting network access to the pods running the multicluster-observability-addon to trusted internal components and applying network policies to block untrusted inbound connections to these ports.

The vulnerability allows unauthorized disclosure of sensitive operational information such as goroutine stacks, heap data, and command-line arguments. This information leakage can aid attackers in reconnaissance activities but does not allow direct remote code execution or integrity compromise. The impact is limited to confidentiality and availability with low severity on confidentiality and availability, and no impact on integrity.

Red Hat advises restricting network access to the pods running the multicluster-observability-addon to trusted internal components only. Implement Kubernetes network policies to limit inbound connections on ports 6060 and 8443 to trusted sources, thereby preventing unauthorized access to the unauthenticated debug endpoints. No official patch or fix is currently indicated in the advisory; operational controls are the recommended mitigation.