A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/submariner-io/submariner-operator(Go) | 0.16.0-m0 | 0.16.4 | N/A |
| github.com/submariner-io/submariner-operator(Go) | 0.17.0-m0 | 0.17.2 | N/A |
| github.com/submariner-io/submariner-operator(Go) | 0 | 0.15.4 | N/A |
| github.com/submariner-io/submariner-operator(Go) | 0.18.0-m0 | 0.18.0-rc0 | N/A |
CVSS Metrics
