The Observability Operator prior to version 1.3.0 has a vulnerability where it creates a ClusterRole-bound ServiceAccount when deploying the namespace-scoped Custom Resource MonitorStack. This allows a user with only namespace-level permissions to create a MonitorStack and escalate privileges to cluster-level by impersonating the ServiceAccount, resulting in privilege escalation. The issue is fixed in version 1.3.0.