CVE-2023-2250 | BDVDB-2026-200837 Detail

Description#

A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service account to list all secrets for all kubernetes namespaces, leading into a cluster-level privilege escalation.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12023-04-24Record published in the CVE List.
2. Version 22025-02-04Most recent update recorded in the CVE List.