Bug 2506771 (CVE-2026-17107)
| Summary: | CVE-2026-17107 cluster-proxy: Impersonation-header injection grants cluster-admin on every managed cluster | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | gparvin, rhaigner, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
A flaw was found in the cluster-proxy service-proxy component (stolostron/cluster-proxy), shipped as part of multicluster-engine for Red Hat Advanced Cluster Management. The spoke-side service-proxy uses `req.Header.Add("Impersonate-Group", ...)` to set impersonation headers on proxied requests without first stripping caller-supplied `Impersonate-Group`, `Impersonate-Uid`, or `Impersonate-Extra-*` headers. The hub-side user-server forwards all incoming headers verbatim through the tunnel. Combined with the spoke ServiceAccount's unrestricted `impersonate` permission on `users` and `groups` (no `resourceNames` restriction), any authenticated hub principal — including the lowest-privileged ServiceAccount — can inject `Impersonate-Group: system:masters` and obtain cluster-admin authority on every managed cluster. The vulnerable code is in `pkg/serviceproxy/service_proxy.go` function `processHubUser` (lines 420-451), where `Add` is used for `Impersonate-Group` headers (appending to existing values) while `Set` is used for `Impersonate-User` and `Authorization` (overwriting). The hub-side user-server at `pkg/userserver/user_server.go` lines 198-226 uses `httputil.NewSingleHostReverseProxy` which preserves all request headers. Identified during the HP Mythos (Project Glasswing) security audit of stolostron/cluster-proxy at commit ac25e0c02e33.