Threats tagged 'ghsa-3hch-x692-6qj3'

GPUStack versions 2.2.0 up to but not including 2.2.2 contain an authorization bypass vulnerability in the Kubernetes API proxy. Authenticated non-administrative users can access Kubernetes clusters they are not authorized for by exploiting missing resource-level authorization checks. This allows attackers to read, modify, or delete Kubernetes resources depending on the permissions of the worker's ServiceAccount, potentially leading to code execution in the target cluster. The issue is fixed in version 2.2.2.