ClusterCurator Job Injection Privilege Escalation in Multicluster Engine

Technical Analysis

The vulnerability resides in the CreateJob() function, which unmarshals the user-supplied spec.install.overrideJob raw extension without validating its contents. A tenant possessing only create or update permissions on ClusterCurator resources can craft a malicious Job spec that is executed by the controller's service account, which typically holds cluster-admin-like privileges within MCE-managed environments. This constitutes a classic input validation failure leading to privilege escalation and lateral movement across managed clusters, with potential exposure of cluster-wide secrets including credentials, tokens, and kubeconfig data. Organizations running AI agent orchestration, RAG pipelines, or LLM tool-execution workloads on OpenShift/Kubernetes clusters managed by MCE are directly exposed, since compromised cluster-wide secrets could include API keys, model endpoints, and vector database credentials used by agent frameworks, and the injected Job could pivot into agent-hosting namespaces to exfiltrate data or hijack agent execution environments.

Affected Systems

Red Hat Advanced Cluster Management (RHACM) and multicluster engine (MCE) deployments utilizing the cluster-curator-controller component; specifically environments where tenants are granted create/update RBAC permissions on ClusterCurator custom resources.

Indicators of Compromise

• No specific hashes, IPs, or domains identified; indicators would include anomalous Job objects with unexpected overrideJob specifications, unauthorized Job creation events in ClusterCurator-related namespaces, and unexpected service account token usage from curator-controller pods.

Remediation Steps

1. 1

   Apply vendor patch

   Update multicluster engine and cluster-curator-controller to the patched version provided by Red Hat that enforces validation on spec.install.overrideJob.

2. 2

   Restrict RBAC permissions

   Limit create/update permissions on ClusterCurator resources to trusted administrators only; audit existing RoleBindings and ClusterRoleBindings granting tenant access.

3. 3

   Monitor Job creation

   Implement admission controllers or policy engines (e.g., OPA/Gatekeeper, Kyverno) to validate and restrict Job specs created via ClusterCurator resources.

4. 4

   Audit cluster secrets

   Review and rotate cluster-wide secrets and service account tokens accessible to the curator-controller, including any credentials used by AI agent or automation pipelines running on the cluster.

5. 5

   Enable audit logging

   Enable and review Kubernetes audit logs for anomalous Job creation or privilege escalation attempts tied to ClusterCurator resource modifications.