Fix for vulnerability in TCPs API servers

CVE-2024-42480

What is CVE-2024-42480?

The Kamaji Hosted Control Plane Manager for Kubernetes has a vulnerability in its role-based access control (RBAC) settings used for etcd roles. This misconfiguration allows certain TCPs API servers to inadvertently gain access to read, write, and delete sensitive data of other control planes. This can result in unauthorized data exposure and management, raising significant security concerns. The issue has been addressed in version edge-24.8.2, which rectifies the RBAC definition to improve isolation between control planes. For a comprehensive understanding of the changes, refer to the official commit and advisory links.

References