Executive brief
A security flaw in Red Hat Advanced Cluster Security (RHACS) allows users with basic deployment permissions to bypass security policy enforcement and monitoring. By applying a specific label to a Kubernetes deployment, an attacker can hide their workloads from the security console, preventing the system from detecting policy violations or maintaining compliance records. This effectively creates a blind spot in the cluster's security oversight, allowing potentially unauthorized or non-compliant containers to run undetected.
Technical details
A vulnerability classified as Insufficient Verification of Data Authenticity (CWE-345) exists in RHACS during the processing of Kubernetes Deployments. The component responsible for identity metadata replacement reads the 'openshift.io/encoded-deployment-config' label and performs JSON unmarshaling on its value. An attacker with 'create deployment' permissions can set this label to 'null', which is a valid Kubernetes label value but causes the ACS Sensor to treat the workload as having an empty UID, name, and labels, while defaulting the namespace to 'default'. This metadata collision and erasure prevents the Central component from correctly persisting the deployment, effectively bypassing deploy-time policy enforcement and visibility while the container specs remain active.
Affected products
- Red Hat Advanced Cluster Security for Kubernetes 4
Timeline
- 2026-05-29: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-31: advisory: NVD publication date