Bug 2509774 (CVE-2026-66808)

Summary: CVE-2026-66808 hypershift-addon-operator: hypershift-addon-operator: unsanitized hub ConfigMap data passed as CLI arguments to privileged install Job (argument injection)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: gparvin, rhaigner, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in hypershift-addon-operator. A hub-cluster administrator with write access to the hypershift-operator-install-flags ConfigMap can inject malicious command-line arguments into the privileged install Job. This vulnerability, known as argument injection, allows the attacker to pull arbitrary container images and gain full administrative control (cluster-admin code execution) on managed spoke clusters.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-31 13:34:24 UTC 
A flaw was found in hypershift-addon-operator. The buildOtherInstallFlags() function in pkg/install/hypershift.go reads arbitrary key-value pairs from the hypershift-operator-install-flags ConfigMap and appends them unsanitized as CLI arguments to the hypershift install Job. A hub-cluster namespace administrator with write access to this ConfigMap can inject arbitrary flags into the privileged install Job, enabling arbitrary image pull and cluster-admin code execution on managed spoke clusters.

The vulnerable code path is: pkg/install/hypershift.go lines 428-506 (buildOtherInstallFlags) and pkg/install/install_job.go lines 19-41 (Job construction). The install Job runs with elevated privileges sufficient to deploy the HyperShift operator on spoke clusters.

Attack scenario: An attacker with namespace-admin privileges on the hub cluster writes crafted entries to the hypershift-operator-install-flags ConfigMap. When the addon-manager reconciles, it invokes buildOtherInstallFlags() which blindly converts ConfigMap data entries into --key=value flags passed to the hypershift install command. The attacker can inject flags such as --image-refs to pull a malicious operator image, achieving cluster-admin execution on the target spoke cluster.

This vulnerability was identified during an authorized security assessment (Project Glasswing). Execution was proven in a controlled test environment.