The OpenShift API Server failed to sufficiently protect OAuthTokens by leaking them in the logs when a API Server panic occured. An attacker with the ability to cause a API Server panic, and read the logs and use the leaked OAuthToken to log into the API Server with the leaked token.
The immediate problem is this line of code [1], however the fix is none trivial and requires a reworking of oauthtokens in OpenShift [2]. [1] https://github.com/openshift/origin/blob/master/vendor/k8s.io/kubernetes/staging/src/k8s.io/apiserver/pkg/server/filters/wrap.go#L39 [2] https://github.com/openshift/enhancements/pull/323
Statement: OAuthTokens are only valid for 1 day by default.
Mitigation: Ensure the OpenShift API Server logs are kept private