CyberRota Analysis
AI-GeneratedA critical vulnerability exists in the multicloud-integrations component, where the Application propagation controller improperly validates the `ocm-managed-cluster` annotation from Application Custom Resources. This flaw allows an authenticated tenant to exploit the system, potentially synchronizing malicious manifests in managed clusters, which could result in arbitrary code execution or privilege escalation. Organizations using this component, particularly those with multi-tenant environments, should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.