CyberRota Analysis
AI-GeneratedA vulnerability in the managedcluster-import-controller allows a privileged service account on a spoke cluster to submit a malicious Certificate Signing Request (CSR) due to improper validation of incoming CSRs. This flaw can lead to privilege escalation, granting attackers administrative access to the hub cluster. Organizations using this controller, particularly those managing multiple clusters, should prioritize addressing this critical issue to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.