REDHAT-BUG-2531596: High severity multicluster-observability-addon vulnerability
A flaw in multicluster-observability-addon allows a managed-cluster identity to reference configuration resources outside its permitted namespace. This may cause the add-on to disclose referenced hub Secrets to the attacker-controlled managed cluster.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this flaw?
An attacker needs control of, or the ability to act as, a managed-cluster identity. The issue affects environments where that identity can cause the add-on to reference configuration resources outside its permitted namespace.
What information could be exposed?
Referenced hub Secrets may be disclosed to the attacker-controlled managed cluster. The provided information does not identify specific Secret types or contents.
Does the available information confirm that default configurations are affected?
No. The provided data does not state whether the vulnerable resource-reference behavior is enabled or reachable in a default deployment.