CVE-2024-9779

HIGH 7.5

Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.

CWE	CWE-266
Published	Dec 17, 2024
Last Updated	Feb 25, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new high vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-9779 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2317916 github.com: https://github.com/open-cluster-management-io/ocm/pull/325 github.com: https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0 github.com: https://github.com/open-cluster-management-io/registration-operator/issues/361

Credits

Red Hat would like to thank Nanzi Yang and Xingyu Liu for reporting this issue.