Executive brief
A security flaw in the Red Hat Cluster Observability Operator allows users with limited, restricted access to a specific part of a Kubernetes cluster to gain full control over the entire cluster. By creating a specific monitoring resource, a low-privileged user can trick the system into granting them high-level administrative permissions. This could lead to unauthorized access to sensitive data across the entire organization or the ability to disrupt all services running on the cluster.
Technical details
A privilege escalation vulnerability exists in the Observability Operator due to incorrect privilege assignment (CWE-266). The operator defines the 'MonitorStack' Custom Resource (CR) as namespace-scoped, allowing users with only local namespace 'Role' permissions to deploy it. However, the operator's reconciler automatically creates a ServiceAccount with 'ClusterRole' permissions upon deployment of the CR. An attacker with limited namespace access can deploy a MonitorStack and subsequently impersonate the newly created ServiceAccount to elevate their permissions from the namespace level to the cluster level. This issue is fixed in version 1.3.0 and later.
Affected products
- Red Hat Cluster Observability Operator 0 to 1.3.0
- rhobs observability-operator 0 to 1.3.0
Timeline
- 2025-11-12: advisory: Red Hat published security advisory RHSA-2025:21146
- 2025-11-12: disclosed