Executive brief
A security flaw exists in the component responsible for managing communications between different Kubernetes clusters in Red Hat Advanced Cluster Management. An authorized user with low-level access could bypass security controls to gain full administrative control over every managed cluster in the environment. This could lead to complete data exposure, service disruption, or unauthorized modification of critical infrastructure across the entire multi-cluster network.
Technical details
A 'Confused Deputy' vulnerability (CWE-441) exists in the cluster-proxy service-proxy component of RHACM and MCE. The service-proxy appends 'Impersonate-Group' headers to proxied requests using the 'Add' method instead of 'Set', failing to remove existing caller-supplied headers. Because the hub-side user-server forwards all headers verbatim and the spoke ServiceAccount possesses unrestricted impersonation permissions, an authenticated attacker can inject 'Impersonate-Group: system:masters' into a request. This allows the attacker to escalate privileges to cluster-admin across all managed clusters. The vulnerability is located in the 'processHubUser' function within 'pkg/serviceproxy/service_proxy.go'.
Affected products
- Red Hat Red Hat Advanced Cluster Management for Kubernetes (RHACM)
- Red Hat Multicluster Engine for Kubernetes (MCE)
Timeline
- 2026-07-24: disclosed: Initial vulnerability report and NVD publication