A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). The application-manager addon's ClusterRole grants apiGroups: resources: verbs: (plus nonResourceURLs:) and is bound to the application-manager ServiceAccount on every managed cluster via the addon framework. This wildcard RBAC is the root enabler for multiple confused-deputy attacks where a namespace-admin tenant can create Subscription CRs that deploy arbitrary cluster-scoped resources using this privileged SA. A least-privilege variant exists in addon/manifests/permission/role.yaml but is not used by default.

Upstream repo: https://github.com/stolostron/multicloud-operators-subscription Audited commit: 48ae4defaa5b719e0664e1de7413c96029c938bc Jira tracker: ACM-38624

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.