Executive brief
Red Hat's volsync-addon-controller is a component used to manage storage data synchronization within OpenShift Kubernetes clusters. A flaw in how annotation values are escaped allows attackers to inject malicious YAML code into OpenShift Lifecycle Manager (OLM) Subscription configurations when the volsync addon is deployed. This could enable attackers to modify or hijack software package management within the cluster, potentially leading to unauthorized software installation or disruption of cluster operations.
Technical details
This vulnerability is a YAML injection flaw (CWE-94/code injection) in the volsync-addon-controller component. The root cause is improper escaping of annotation values when they are rendered into YAML templates for OLM Subscription resources. An attacker with the ability to set annotations (or control annotation values) on resources can inject arbitrary YAML syntax that breaks out of the intended annotation context. The vulnerability requires the 'volsync-addon-deploy-type: olm' annotation to be explicitly enabled. Successful exploitation allows modification of OLM Subscription configurations, potentially leading to unauthorized cluster package management or supply chain compromise. Patches are available through Red Hat's security updates.
Affected products
- Red Hat Advanced Cluster Management for Kubernetes 2.17.1
Timeline
- 2026-08-19: disclosed
- 2026-08-26: patched: Security advisory RHSA-2026:60386 issued with container image updates