CVE-2025-11393 is a vulnerability in the runtimes-inventory-rhel8-operator component of Red Hat Lightspeed for Runtimes 1.0.0 on RHEL 9 container images. An internal proxy is misconfigured such that it attaches the cluster's main administrative credentials to any command it receives, rather than restricting credentials to specific reports. This misconfiguration allows a standard user within the cluster to send unauthorized commands to the management platform, effectively gaining full cluster administrator privileges. Red Hat has released updated container images with backported patches to fix this issue and advises users to upgrade and rebuild dependent images. A mitigation involves disabling the proxy server via environment configuration, which causes a crash loop in the Insights container but prevents exploitation. The vulnerability has a CVSS v3.1 base score of 8.7 (High) according to Red Hat's scoring.

The vulnerability allows a standard user within the cluster to escalate privileges by sending unauthorized administrative commands to the management platform, acting with full cluster administrator permissions. This could lead to unauthorized changes to the cluster's configuration or status, potentially compromising cluster integrity and security. There is no indication of impact on availability. No known exploits in the wild have been reported.

Red Hat has released updated container images with backported patches that fix this vulnerability. Users should upgrade to these updated images and rebuild all container images that depend on them. As a temporary mitigation, users can disable the affected proxy server by adding the environment variable INSIGHTS_ENABLED=false to the Cryostat or JWS subscription YAML configuration. Note that this mitigation causes a crash loop in the Insights container, which is harmless. Users should apply all previously released errata relevant to their system before updating. Check the Red Hat advisory RHSA-2025:23236 for detailed update instructions.