-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the over-permissive ClusterRole bound to the 'cluster-manager' service account. The ClusterRole's Pod creation permissions (visible in the pre-patch RBAC configuration) enabled attackers to exploit the service account token. The fix in PR #325 explicitly removed these permissions, confirming this as the root cause. While no traditional code functions are mentioned, the RBAC configuration acts as the security boundary in this Kubernetes context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-cluster-management.io/ocm | go | < 0.13.0 | 0.13.0 |
Ongoing coverage of React2Shell