Description

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-17T21:16:47.163Z",
  "pubdate": "2026-08-17T21:16:47.163Z",
  "executiveSummary": "An improper validation vulnerability exists within the Certificate Signing Request (CSR) auto-approval logic of the managedcluster-import-controller. This security flaw enables a privileged service account operating on a spoke cluster to submit a maliciously crafted CSR that bypasses standard validation controls.\nSuccessful exploitation of this vulnerability results in privilege escalation, allowing an attacker to acquire administrative credentials and unauthorized administrative access on the central hub cluster. The attack requires a compromised or privileged service account on a managed spoke cluster to initiate the malicious CSR submission against the vulnerable import controller.\nThe risk implications are severe, as compromising the hub cluster grants the attacker overarching control over all managed spoke clusters connected to the infrastructure. Organizations utilizing the affected component are exposed to complete cluster takeover and cross-cluster compromise if appropriate validation controls are absent.",
  "technicalDetails": "The vulnerability resides in the Certificate Signing Request (CSR) auto-approval logic managed by the managedcluster-import-controller component. The root cause of the flaw stems from the controller's failure to adequately inspect incoming CSR payloads. Specifically, the component does not inspect the signer name specified in the request, nor does it decode and parse the PEM-encoded x509 certificate signing request to verify its intended attributes and subject constraints.\nExploitation of this vulnerability requires an attacker to possess a privileged service account on a spoke cluster. Because the managedcluster-import-controller automatically processes and approves incoming CSRs from managed clusters without performing rigorous cryptographic and structural validations, an attacker can craft and submit a malicious CSR designed to request high-privilege certificates.\nThe attack flow proceeds as follows: First, the attacker leverages an existing privileged service account on a spoke cluster to generate a specially crafted, PEM-encoded x509 CSR. Second, the attacker submits this malicious CSR to the Kubernetes API server, where the managedcluster-import-controller observes and processes the request. Third, due to the lack of signer name inspection and PEM decoding in the auto-approval logic, the controller evaluates the request as legitimate and automatically approves it. Finally, the approved CSR is utilized to issue administrative credentials, enabling the attacker to authenticate against the hub cluster with elevated privileges.\nThe post-exploitation impact includes full administrative control over the hub cluster, facilitating lateral movement, unauthorized data access, and complete administrative compromise across the multi-cluster management architecture."
}