What’s Vulnerable › Vulnerabilities

CVE-2024-5042: Submariner-operator: rbac permissions can allow for the spread of node compromises

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-17 · updated 2026-10-14
• Weakness: CWE-250

Description

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

Affected products

• Red Hat Advanced Cluster Management for Kubernetes 2: all versions
• Red Hat Openshift Data Foundation 4.20: all versions — fixed in 1774540668, 1774540992, 1774541259, 1774541345, 1774541420, 1774541448
• Red Hat RHODF-4.16-RHEL-9: all versions — fixed in v4.16.0-19

How to fix

Upgrade to a fixed version: Red Hat Openshift Data Foundation 4.20 1774540668, 1774540992, 1774541259, 1774541345; Red Hat RHODF-4.16-RHEL-9 v4.16.0-19. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:4591
• https://access.redhat.com/errata/RHSA-2026:6503
• https://access.redhat.com/security/cve/CVE-2024-5042
• https://bugzilla.redhat.com/show_bug.cgi?id=2280921
• https://github.com/advisories/GHSA-2rhx-qhxp-5jpw
• https://access.redhat.com/errata/RHSA-2024:4591
• https://access.redhat.com/security/cve/CVE-2024-5042
• https://bugzilla.redhat.com/show_bug.cgi?id=2280921
• https://github.com/advisories/GHSA-2rhx-qhxp-5jpw

Get alerted when CVE-2024-5042 or the next vulnerability affects your stack