The vulnerability in Red Hat's Cluster Observability Operator 1.3.0 arises from the Operator creating a ServiceAccount with ClusterRole bindings upon deployment of the namespace-scoped MonitorStack custom resource. An adversary with namespace-level permissions can exploit this by creating a MonitorStack in an authorized namespace and impersonating the Operator-created ServiceAccount, thereby escalating privileges to the cluster level. This issue is tracked as CVE-2025-2843 and is associated with CWE-266 (Incorrect Privilege Assignment) and CWE-330. Red Hat has assigned a CVSS v3.1 base score of 8.8 (High) and classifies the impact as Important. No fix or mitigation is currently available, and users are advised to monitor Red Hat advisories for updates.

An attacker with namespace-level privileges can escalate their permissions to cluster-level by exploiting the impersonation of a ServiceAccount created by the Cluster Observability Operator. This privilege escalation can lead to broader cluster access, potentially compromising confidentiality, integrity, and availability at a high level. The vulnerability affects the security boundary within Kubernetes clusters managed by the Operator.

Currently, Red Hat has not provided any mitigation or patch for this vulnerability. Users should apply all previously released errata relevant to their systems and monitor Red Hat advisories for updates. No workaround or temporary fix is available at this time.