Bug 2507540 (CVE-2026-66795)

Summary:	CVE-2026-66795 managedcluster-import-controller: managedcluster-import-controller: CSR auto-approver does not validate certificate Subject, signerName, or requester identity
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 15:46:00 UTC

The CSR auto-approval logic checks: (1) csr.Labels[open-cluster-management.io/cluster-name] — attacker-controlled (any CSR creator sets labels); (2) csr.Spec.Username must equal system:serviceaccount:clusterName:clusterName-bootstrap-sa or system:serviceaccount:open-cluster-management-hub:grpc-server-sa; (3) existence of a ManagedCluster named clusterName. It never decodes csr.Spec.Request (the PEM-encoded x509 CSR) and never inspects csr.Spec.SignerName. The hub controller's own ClusterRole grants certificatesigningrequests/approval:update and signers:approve with no resourceNames restriction. A spoke bootstrap SA can submit a CSR requesting system:masters group membership with any signerName, get it auto-approved, and obtain hub cluster-admin credentials.

Source: Project Glasswing AI-SAST audit of stolostron/managedcluster-import-controller.
Finding ID: FIND-001
Assurance: execution_proven
Note: Live validation on running cluster did not reproduce (countersign conflict). Code-level vulnerability confirmed via static analysis.