Bug 2355222 (CVE-2025-2843)

Summary:	CVE-2025-2843 observability-operator: Observability Operator privilege escalation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alcohan, gparvin, njean, owatkins, pahickey, rhaigner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-03-27 03:15:29 UTC

The Custom Resource |MonitorStack| is defined at the Namespace scope
(https://github.com/rhobs/observability-operator/blob/73db74f3f56aa46b775e1b79003c093bb5c24ed6/deploy/crds/common/monitoring.rhobs_monitoringstacks.yaml#L16).
In Kubernetes, this means an account with namespaced Roles and without
ClusterRoles may deploy the Custom Resource.

The corresponding reconciler creates a ServiceAccount with ClusterRole
when deploying |MonitorStack|
(https://github.com/rhobs/observability-operator/blob/73db74f3f56aa46b775e1b79003c093bb5c24ed6/pkg/controllers/monitoring/monitoring-stack/components.go#L76,
https://github.com/rhobs/observability-operator/blob/73db74f3f56aa46b775e1b79003c093bb5c24ed6/pkg/controllers/monitoring/monitoring-stack/components.go#L82),
which means that an adversary with limited access (e.g., a malicious
tenant assigned only Role privileges within his namespace, or a
Kubernetes Workload compromised by an attacker with a Role-privileged
Service Account mounted) to a K8s cluster could deploy the
|MonitorStack| in their authorized namespace and then elevate his
permission to cluster level by impersonating the ServiceAccount created
by the Operator.