~ / search / GHSA-mj6p-p843-x5wc

GHSA-mj6p-p843-x5wc

Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack

Source: GitHub Advisory Database (reviewed) High CVE-2025-2843

Packages

EcosystemPackageAffectedFixed in
Go github.com/rhobs/observability-operator < 1.3.0 1.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.

References

External links from the advisory. They lead to third-party sites.