CVE-2025-2843 | BDVDB-2026-301689 Detail

Description#

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-11-12Record published in the CVE List.
2. Version 22026-09-21Most recent update recorded in the CVE List.