REDHAT-BUG-2507527: High severity submariner-operator vulnerability
Long-lived broker SA bearer token may be placed directly in the Submariner CR .spec field. Per the broker shared-trust findings, possession of any broker token grants full mesh control (CRUD on all endpoints, secrets, and endpointslices in the broker namespace). Same etcd-cleartext / kubectl get / must-gather exposure as the PSK cleartext finding.
Source: Project Glasswing AI-SAST audit of submariner-io/submariner-operator. Finding ID: FIND-004 Assurance: executionproven
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this?
An attacker must obtain any broker token. Possession of a broker token grants full mesh control, including CRUD access to endpoints, secrets, and EndpointSlices in the broker namespace.
Where should teams look for potential token exposure?
The token can be exposed through cleartext storage in etcd, access to the custom resource through kubectl get, or diagnostic data collected by must-gather. Environments where the token is placed directly in the Submariner custom resource spec are affected by these exposure paths.