OSAC operator: unsanitized kubeconfig Secret runs an exec credential plugin as the console-proxy pod

Impact

The console-proxy parses kubeconfig data out of a Kubernetes Secret with clientcmd.RESTConfigFromKubeConfig and never sanitizes the resulting rest.Config. A kubeconfig containing users[].user.exec therefore makes client-go spawn an attacker-chosen process inside the proxy pod, running as the osac-console-proxy service account, the moment a transport is built for an upstream WebSocket connection. That is arbitrary code execution with the proxy's in-cluster identity and whatever its service account can reach. A second path remains open: an attacker-controlled clusters[].server turns the proxy into an SSRF relay into the cluster network, which on a GPU cluster includes management and fabric endpoints that are normally unreachable from a tenant workload. Remote and auto VM cluster modes are affected and auto is the default; a deployment running exclusively in local mode does not read kubeconfig Secrets and is unaffected.

Who can reach it

An authenticated principal able to create or modify a Secret labeled osac.openshift.io/remote-cluster-kubeconfig=true in a namespace where the proxy's RoleBinding grants it Secret read access. Requires existing namespace write access, not an unauthenticated network position.

What to do

Take commit 7e4222b (or the release carrying it) and roll the operator and console-proxy deployment - a pod restart, no node drain. Note that patch closes only the credential-plugin execution path; the attacker-controlled server-address SSRF path is not addressed, so also narrow which namespaces and principals can write Secrets carrying that label, and switch cluster mode to local where remote access is not required. No fixed version number is published in the record beyond that commit.

References

Related entries

• Harbor (harbor-helm, default core.secretName JWT signing key): SUPPLY CHAIN, UNAUTHENTICATED REGISTRY ACCESS: HarborNCVD-2023-011-harbor-harbor-helm-default-core · Harbor (harbor-helm, default core.secretName JWT signing key)High
• Helm: The `lookup` template function discloses in-cluster resources, including Secrets, to a chart authorCVE-2020-11013 · HelmHigh
• runc: Container filesystem breakout via directory traversal in mount handlingCVE-2021-30465 · runcHigh
• Argo CD: Authorization bypass lets an Application be synced to a destination it is not permitted to reachCVE-2023-22736 · Argo CDHigh
• KubeVirt CDI: PVCs can be cloned from unauthorized namespaces via DataImportCronCVE-2025-14459 · KubeVirt CDIHigh
• Helm: Crafted Chart.yaml plus a symlinked Chart.lock gives local code execution when dependencies are updatedCVE-2025-53547 · HelmHigh