A flaw was found in the cluster-proxy service-proxy component (stolostron/cluster-proxy), shipped as part of multicluster-engine for Red Hat Advanced Cluster Management. The spoke-side service-proxy uses `req.Header.Add("Impersonate-Group", ...)` to set impersonation headers on proxied requests without first stripping caller-supplied `Impersonate-Group`, `Impersonate-Uid`, or `Impersonate-Extra-*` headers. The hub-side user-server forwards all incoming headers verbatim through the tunnel. Combined with the spoke ServiceAccount's unrestricted `impersonate` permission on `users` and `groups` (no `resourceNames` restriction), any authenticated hub principal — including the lowest-privileged ServiceAccount — can inject `Impersonate-Group: system:masters` and obtain cluster-admin authority on every managed cluster.

The vulnerable code is in `pkg/serviceproxy/service_proxy.go` function `processHubUser` (lines 420-451), where `Add` is used for `Impersonate-Group` headers (appending to existing values) while `Set` is used for `Impersonate-User` and `Authorization` (overwriting). The hub-side user-server at `pkg/userserver/user_server.go` lines 198-226 uses `httputil.NewSingleHostReverseProxy` which preserves all request headers.

Identified during the HP Mythos (Project Glasswing) security audit of stolostron/cluster-proxy at commit ac25e0c02e33.