Vulnerability in Open Cluster Management Impacting Cluster-Manager Deployments

Summary

CVE-2024-9779 is a critical vulnerability found within Open Cluster Management (OCM) that allows unauthorized access to cluster-manager deployments. If an attacker gains access to a worker node, they can exploit this flaw due to a permissive service account configuration. The cluster-manager deployment utilizes a service account sharing its name with the ClusterRole, granting permissions to create Pod resources. An attacker controlling a node can obtain the sensitive cluster-manager token, allowing them to access and manipulate the entire cluster by mounting malicious service accounts. This poses a significant risk to the confidentiality, integrity, and availability of managed clusters, necessitating immediate attention and remediation.

References