GHSA-2rhx-qhxp-5jpwMediumCVSS 6.6

Submariner Operator sets unnecessary RBAC permissions

Published
May 17, 2024
Last Modified
April 6, 2026

🔗 CVE IDs covered (1)

CVE-2024-5042 →

📋 Description

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

🎯 Affected products4

  • go/github.com/submariner-io/submariner-operator:>= 0.16.0-m0, < 0.16.4
  • go/github.com/submariner-io/submariner-operator:>= 0.17.0-m0, < 0.17.2
  • go/github.com/submariner-io/submariner-operator:< 0.15.4
  • go/github.com/submariner-io/submariner-operator:>= 0.18.0-m0, < 0.18.0-rc0

🔗 References (12)