REDHAT-BUG-2514225: High severity Red Hat Red Hat Advanced Cluster Management (RHACM) vulnerability
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). The application-manager addon's ClusterRole grants apiGroups: resources: verbs: (plus nonResourceURLs:) and is bound to the application-manager ServiceAccount on every managed cluster via the addon framework. This wildcard RBAC is the root enabler for multiple confused-deputy attacks where a namespace-admin tenant can create Subscription CRs that deploy arbitrary cluster-scoped resources using this privileged SA. A least-privilege variant exists in addon/manifests/permission/role.yaml but is not used by default.
Upstream repo: https://github.com/stolostron/multicloud-operators-subscription Audited commit: 48ae4defaa5b719e0664e1de7413c96029c938bc Jira tracker: ACM-38624
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat Advanced Cluster Management (RHACM) - multicloud-operators-subscription (application-manager addon)to a version that resolves this vulnerability.Patch ACM-38624 - Configuration
Use the least-privilege RBAC variant defined in addon/manifests/permission/role.yaml instead of granting apiGroups:* resources:* verbs:* (including nonResourceURLs:*), and ensure the application-manager ClusterRole bound to the application-manager ServiceAccount on managed clusters no longer uses wildcard permissions.
application-manager addon (addon framework) ClusterRole rules = Replace wildcard ClusterRole permissions apiGroups:* resources:* verbs:* (and nonResourceURLs:*) with least-privilege rules from addon/manifests/permission/role.yaml - Compensating control
Until the RBAC is corrected, prevent namespace-admin tenants from being able to create Subscription CRs that would be reconciled to deploy cluster-scoped resources using the privileged application-manager ServiceAccount (e.g., restrict permissions to create Subscription CRs / deny access to the Subscription API to untrusted tenants).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2514225?
The severity of REDHAT-BUG-2514225 is classified as high with a score of 7.
What issues are caused by REDHAT-BUG-2514225?
REDHAT-BUG-2514225 exposes certain resources to unauthorized access due to overly permissive ClusterRole permissions.
How do I fix REDHAT-BUG-2514225?
To fix REDHAT-BUG-2514225, you should review and restrict the permissions associated with the application-manager ClusterRole.
Which component is affected by REDHAT-BUG-2514225?
The REDHAT-BUG-2514225 affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management.
What is the potential impact of REDHAT-BUG-2514225?
The potential impact of REDHAT-BUG-2514225 includes unauthorized access to resources across managed clusters.