CVE-2025-2843

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2025:21146
https://access.redhat.com/security/cve/CVE-2025-2843
https://bugzilla.redhat.com/show_bug.cgi?id=2355222

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en el Operador de Observabilidad. El Operador crea una ServiceAccount con ClusterRole al desplegar el Recurso Personalizado MonitorStack de ámbito de espacio de nombres (Namespace-Scoped). Este problema permite que una Cuenta de Kubernetes adversaria con solo roles a nivel de espacio de nombres, por ejemplo, un inquilino que controla un espacio de nombres, cree un MonitorStack en el espacio de nombres autorizado y luego eleve los permisos al nivel de clúster al suplantar la identidad de la ServiceAccount creada por el Operador, lo que resulta en escalada de privilegios y otros problemas.

Information

Published : 2025-11-12 17:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-2843

Mitre link : CVE-2025-2843

CVE.ORG link : CVE-2025-2843

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2025-2843", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2843", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T20:47:54.311119Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "rhobs", "product": "observability-operator", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0", "versionType": "semver"}], "packageName": "observability-operator", "collectionURL": "https://github.com/rhobs/observability-operator", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:cluster_observability_operator:1.3::el9"], "vendor": "Red Hat", "product": "Cluster Observability Operator 1.3.1", "versions": [{"status": "unaffected", "version": "1.3.0-1762825457", "lessThan": "*", "versionType": "rpm"}], "packageName": "cluster-observability-operator/cluster-observability-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2025-11-12T17:15:37.550", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:21146", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-2843", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355222", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el Operador de Observabilidad. El Operador crea una ServiceAccount con ClusterRole al desplegar el Recurso Personalizado MonitorStack de \u00e1mbito de espacio de nombres (Namespace-Scoped). Este problema permite que una Cuenta de Kubernetes adversaria con solo roles a nivel de espacio de nombres, por ejemplo, un inquilino que controla un espacio de nombres, cree un MonitorStack en el espacio de nombres autorizado y luego eleve los permisos al nivel de cl\u00faster al suplantar la identidad de la ServiceAccount creada por el Operador, lo que resulta en escalada de privilegios y otros problemas."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "secalert@redhat.com"}