Bug 2483158 (CVE-2026-10079)

Summary: CVE-2026-10079 stackrox: stackrox: Deploy-time policy enforcement and visibility bypass via label injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anjoseph, jprabhak, kaycoth, security-response-team, watson-tool-maintainers, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name and labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-29 07:40:28 UTC 
A flaw was found in RHACS. When converting Kubernetes Deployments, ACS reads the label openshift.io/encoded-deployment-config and JSON-unmarshals its value to replace deployment identity metadata. A user with permission to create Deployments can set this label to "null", which is valid under Kubernetes label rules but produces empty metadata (no UID, name, or labels; namespace falls back to "default"). Deploy-time policy violations then disappear from the UI, the deployment is not persisted in Central and affected workloads collide in the Sensor store. Container specs are still read from the real object, but ACS loses the identity needed for enforcement and reporting.