CyberRota Analysis
AI-GeneratedThe vulnerability exists in the provider-credential-controller component of multicluster-engine, allowing an attacker with specific hub cluster permissions and knowledge of previous credential values to bypass authorization. By manipulating `copiedFrom` labels, the attacker can intercept newly rotated provider credentials, resulting in unauthorized access to sensitive information. Organizations utilizing multicluster-engine should prioritize addressing this flaw to protect their credential management processes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.