~ / search / GHSA-gf93-xccm-5g6j

GHSA-gf93-xccm-5g6j

MARIN3R: Cross-Namespace Vulnerability in the Operator

Source: GitHub Advisory Database (reviewed) High CVE-2025-64171

Packages

EcosystemPackageAffectedFixed in
Go github.com/3scale-sre/marin3r < 0.13.4 0.13.4

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Cross-namespace Secret access vulnerability in DiscoveryServiceCertificate allows users to bypass RBAC and access Secrets in unauthorized namespaces. ## Affected Versions All versions prior to v0.13.4 ## Patched Versions v0.13.4 and later ## Impact Users with permission to create DiscoveryServiceCertificate resources in one namespace can indirectly read Secrets from other namespaces, completely bypassing Kubernetes RBAC security boundaries. ## Workarounds Restrict DiscoveryServiceCertificate create permissions to cluster administrators only until patched version is deployed. ## Credit Thanks to @debuggerchen for the responsible disclosure.

References

External links from the advisory. They lead to third-party sites.