CVE-2024-5042 is a flaw in the Submariner operator component of Red Hat Advanced Cluster Management for Kubernetes. Due to unnecessary and overly broad RBAC permissions, a privileged attacker can create, patch, or update statefulsets or replicasets, enabling the deployment of privileged containers that can escape confinement and gain root privileges on worker nodes. This can allow the attacker to steal service account tokens and compromise other nodes within the cluster, potentially leading to full cluster compromise. The vulnerability is tracked under CWEs 250, 20, 125, and 770, indicating issues with execution with unnecessary privileges, improper input validation, out-of-bounds read, and use of potentially dangerous functions. Red Hat has issued a security advisory (RHSA-2026:6503) including this fix in OpenShift Data Foundation 4.20.9. The CVSS v3.1 base score assigned by Red Hat is 6.6 (High), reflecting network attack vector, high attack complexity and privileges required, no user interaction, changed scope, low confidentiality impact, high integrity impact, and no availability impact.

An attacker with privileged access can exploit this vulnerability to run malicious containers with root privileges on worker nodes. This can lead to theft of service account tokens, enabling further compromise of other nodes and potentially the entire Kubernetes cluster. The integrity of the cluster can be severely impacted, while confidentiality impact is low and availability impact is none. This elevates the risk of unauthorized code execution and privilege escalation within the cluster environment.

Red Hat has released an official security update in Red Hat OpenShift Data Foundation 4.20.9 that addresses this vulnerability. Users should apply this update after ensuring all previously released relevant errata have been applied. Detailed update instructions are available in Red Hat's documentation. No additional mitigations are specified beyond applying the official fix.