CVE-2026-75924: Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
Clusters running managed-serviceaccount are exposed if an attacker can compromise an addon-manager pod. The excessive ClusterRole permissions apply cluster-wide, allowing that pod to read secrets in any namespace and approve arbitrary CSRs.
What are the likely consequences of a successful exploit?
The described impact depends on compromise of an addon-manager pod; the provided information does not establish that an unauthenticated or external attacker can exploit it directly. A compromised pod can disclose secrets and potentially escalate privileges by approving CSRs.
How can I assess whether my cluster may already be affected?
Review the ClusterRole assigned to the hub addon-manager for cluster-wide secret read/write permissions and CSR approval privileges. Also investigate addon-manager pod compromise and review CSR approvals and access to secrets across namespaces for suspicious activity.