CVE-2025-64171: MARIN3R: Cross-Namespace Vulnerability in the Operator

The analysis of the security patch commit c60246a43ae8c0c38dd7267f298d68a121a159fa clearly indicates that the vulnerability lies within the getIssuerCertificate function of the CertificateProvider struct, located in internal/pkg/reconcilers/operator/discoveryservicecertificate/providers/marin3r/crud.go. Before the patch, the function directly used the namespace provided in the DiscoveryServiceCertificate's spec.signer.caSigned.secretRef.namespace field to fetch a Kubernetes Secret. This allowed a user who could create a DiscoveryServiceCertificate in a given namespace to craft a resource that points to a Secret in a different, unauthorized namespace, thereby bypassing RBAC. The patch rectifies this by introducing a validation step that compares the namespace of the DiscoveryServiceCertificate resource with the namespace specified in the secretRef. If the namespaces do not match, the operation is aborted, and an error is returned. Therefore, the getIssuerCertificate function is the exact location of the vulnerability, as it was responsible for processing the malicious input (the cross-namespace secret reference).