Privilege Escalation in Multicluster Observability Addon

Executive Summary

This vulnerability is in the multicluster-observability-addon component. It allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to sensitive hub Secrets being disclosed to an attacker controlling a managed cluster.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect configuration resources in the multicluster-observability-addon for improper namespace references. Check for Secrets or ConfigMaps referenced outside the ManagedClusterAddOn namespace or MCOA install namespace. Use commands like 'oc get clusterrolebindings -A' to review permissions and 'oc get secrets -A' to identify exposed Secrets.

Useful 0 Not Useful 0

Impact Analysis

An attacker controlling a managed cluster could access sensitive hub Secrets, potentially leading to information disclosure. The vulnerability requires low privileges and network access, making it exploitable with minimal conditions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive hub Secrets to attacker-controlled managed clusters, which may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule on integrity and confidentiality of protected health information). Unauthorized access to secrets may result in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Since no fixes have been released yet, avoid granting managed clusters excessive permissions. Review namespace configurations to ensure managed-cluster identities cannot reference resources outside their designated namespaces. Monitor for unauthorized access attempts to hub Secrets.

Useful 0 Not Useful 0