CVE-2024-5042

Submariner-operator: rbac permissions can allow for the spread of node compromises

State: Published
Severity: 6.6 Medium
Published: May 17, 2024
Updated: Oct 13, 2026
Reserved: May 17, 2024

Description

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N	redhat

Weaknesses

CWE-250 Execution with Unnecessary Privileges

Affected Products

Product	Versions
submariner-operator	before 0.14.9Affected 0.15.0 to before 0.15.5Affected 0.16.0 to before 0.16.7Affected 0.17.0 to before 0.17.2Affected 0.18.0-m0 to before 0.18.0-rc0Affected
RHODF-4.16-RHEL-9Red Hat	v4.16.0-19 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774540992 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774540668 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541259 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541345 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541880 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541518 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541420 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541448 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541663 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541469 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774542075 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541617 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541614 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541633 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541625 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541625 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774542179 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541779 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541857 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541919 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774541919 and laterNot affected
Red Hat Openshift Data Foundation 4.20Red Hat	1774542101 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat

References

RHSA-2024:4591vendor-advisory
RHSA-2026:6503vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-5042vdb-entry
RHBZ#2280921issue-tracking
https://github.com/advisories/GHSA-2rhx-qhxp-5jpw

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.