Description

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-10T13:17:58.797Z",
  "pubdate": "2026-08-10T13:17:58.797Z",
  "executiveSummary": "A privilege escalation vulnerability exists in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange mechanism.\nThe flaw stems from the use of unanchored regular expressions during the evaluation and mapping of OpenID Connect (OIDC) token claim values against configured administrator M2M role mappings.\nAn authenticated attacker possessing a valid OIDC token can exploit this weakness if their specific claim value forms a superstring matching a targeted, pre-configured regular expression pattern.\nSuccessful exploitation enables unauthorized authorization mapping, allowing the attacker to acquire elevated security roles and permissions within the system that they were never explicitly granted.\nThis introduces significant risk regarding authorization boundaries and confidentiality, integrity, and availability of the affected enterprise cluster security infrastructure.\nThe attack requires the adversary to hold a valid OIDC token, target misconfigured role mappings utilizing unanchored regex, and present a claim payload engineered as a superstring of the intended pattern.",
  "technicalDetails": "The vulnerability resides within the authentication and authorization subsystem of StackRox/RHACS Central, specifically inside the Auth Machine-to-Machine (M2M) token exchange and claim-to-role mapping logic.\nThe root cause of the vulnerability is the improper implementation of regular expression validation, wherein regular expressions lack structural anchors (such as start-of-string ^ and end-of-string $ delimiters).\nDuring the processing of M2M token exchanges, Central validates incoming OIDC tokens by extracting specified claim values and matching them against administrator-defined regular expression patterns to determine role assignments.\nBecause the regular expressions are unanchored, the matching engine searches for the configured pattern as a substring anywhere within the evaluated claim value, rather than enforcing an exact or fully bounded match.\nAn attacker initiates the attack flow by acquiring a valid OIDC token through standard or legitimate authentication channels.\nThe attacker then crafts or modifies the token payload such that the targeted claim value contains the exact configured regex pattern as an internal substring, effectively making the attacker's claim value a superstring of the target pattern.\nWhen the M2M token exchange subsystem evaluates the incoming claim against the unanchored role mapping configuration, the regex engine evaluates the superstring as a positive match.\nConsequently, the system assigns the mapped role associated with the pattern to the attacker's security context, granting unauthorized administrative or elevated capabilities.\nThis privilege escalation occurs without triggering validation errors, bypassing intended authorization boundaries and allowing post-exploitation actions commensurate with the hijacked role within the Central cluster."
}