-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/RedHatInsights/runtimes-inventory-operator | go | <= 0.0.0-20251211184433-5123422abee1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in a misconfigured internal proxy within the runtimes-inventory-rhel8-operator. This proxy incorrectly attaches cluster administrator credentials to all commands it processes, allowing any user who can access it to perform administrative actions. The analysis of the patch commit 5123422abee1 reveals that the vulnerability is mitigated by making the creation of a mutating webhook optional and disabling it by default. This webhook is responsible for setting up the vulnerable proxy.
The vulnerable functions are those involved in the unconditional creation of this webhook prior to the patch. The main function serves as the operator's entrypoint, which calls NewInsightsIntegration and then InsightsIntegration.Setup. The Setup function contained the core logic flaw: it always called createInsightsWebhook, which established the misconfigured proxy. The patch introduces an enable-webhook flag to control this behavior, effectively disabling the vulnerable component by default. Therefore, during exploitation on a vulnerable version, the main and InsightsIntegration.Setup functions would be present in the execution profile leading to the creation of the exploitable proxy.
maincmd/main.go
InsightsIntegration.Setuppkg/insights/setup.go
NewInsightsIntegrationpkg/insights/setup.go