Skip to content
Fencer Intel
medium 6.6

CVE-2024-5042 json

Submariner-operator: rbac permissions can allow for the spread of node compromises

published 2y ago modified 29d ago also GHSA-2rhx-qhxp-5jpw , GO-2024-2866 , EUVD-2024-1367

cvss
6.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

Patch / fix

  • go github.com/submariner-io/submariner-operator 0.15.4, 0.16.4, 0.17.2, 0.18.0-rc0
  • Red Hat RHODF-4.16-RHEL-9 v4.16.0-19
  • Red Hat Red Hat Openshift Data Foundation 4.20 1774540668, 1774540992, 1774541259, 1774541345, 1774541420, 1774541448, 1774541469, 1774541518, 1774541614, 1774541617, 1774541625, 1774541633, 1774541663, 1774541779, 1774541857, 1774541880, 1774541919, 1774542075, 1774542101, 1774542179

Is CVE-2024-5042 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-5042 updated cvss 6.6

submariner-operator: RBAC permissions can allow for the spread of node compromises

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/submariner-gateway-rhel8, rhacm2/submariner-rhel8-operator, rhacm2/submariner-globalnet-rhel8, rhacm2/submariner-route-agent-rhel9
    affected: no fix available
  • Red Hat Openshift Data Foundation 4.20 odf4 1774540668, odf4 1774540992, odf4 1774541259, odf4 1774541345, odf4 1774541420, odf4 1774541448, +14 more
    fixed: vendor fix RHSA-2026:6503
  • Red Hat RHODF 4.16 for RHEL 9 odf4/odf-multicluster-rhel9-operator v4.16.0-19
    fixed: vendor fix RHSA-2024:4591
  • Red Hat Openshift Data Foundation 4.20 odf4 1774545298, odf4 1774545299, odf4 1774545300, odf4 1774545302, odf4 1774545311, odf4 1774545312, +7 more Red Hat RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9 v4.16.0-33, odf4/odf-cli-rhel9 v4.16.0-44, odf4/mcg-core-rhel9 v4.16.0-60, odf4/odf-console-rhel9 v4.16.0-57, odf4/mcg-rhel9-operator v4.16.0-38, odf4/ocs-rhel9-operator v4.16.0-76, +22 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N
GitHub 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/submariner-io/submariner-operator
>=0.16.0-m0, <0.16.4
>=0.17.0-m0, <0.17.2
<0.15.4
>=0.18.0-m0, <0.18.0-rc0
<0.16.4
>=0.17.0
0.16.4
0.17.2
0.15.4
0.18.0-rc0

Affected products

  • Red Hat RHODF-4.16-RHEL-9
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.