The vulnerability exists in the assisted-service REST API of the Multicluster Engine (MCE) for Kubernetes, specifically in the local authentication mode used in on-premises deployments. The local authenticator grants full administrative access to any request with a valid JWT token, which is embedded in plaintext as a query parameter in InfraEnvStatus.ISODownloadURL. Since any user with get rights on an InfraEnv object in their namespace can read this URL, they can extract the JWT and use it to access administrative credentials (kubeadmin password) for arbitrary clusters provisioned through the hub. This flaw allows privilege escalation from minimal namespace-scoped privileges to cluster administrative access.

An authenticated user with minimal namespace-scoped privileges can escalate their privileges to obtain administrative credentials for any cluster managed by the Multicluster Engine hub. This compromises cluster confidentiality by exposing kubeadmin passwords and kubeconfig files, potentially allowing full administrative control over those clusters. The vulnerability does not affect availability or integrity directly but poses a significant confidentiality risk.

According to the Red Hat advisory, no official fix or patch is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should restrict access rights to InfraEnv objects to trusted users only, minimizing the risk of unauthorized JWT token exposure. Monitor Red Hat advisories for updates and apply patches or updated container images once they become available.