The cluster-backup-operator creates Velero Restore objects with IncludeClusterResources=true and ExistingResourcePolicy=update (controllers/restore.go setOptionalProperties()), excluding only CustomResourceDefinition from ExcludedResources. The backup schedule limits backups to specific API groups (open-cluster-management.io, hive.openshift.io, etc.) that do not include rbac.authorization.k8s.io, but the restore path does not re-apply this allow-list — it trusts whatever is inside the backup tarball fetched from object storage.

An attacker who can write to the backup storage location (e.g. S3 bucket) or create a Velero Backup object directly can inject a ClusterRoleBinding granting themselves cluster-admin. When a Restore CR is created in the open-cluster-management-backup namespace, the operator restores the tampered backup content including the malicious RBAC objects, escalating the attacker from backup-namespace-admin to hub cluster-admin.

Additionally, getVeleroBackupName (restore.go:678-687) resolves a user-supplied backup name by bare {Name, Namespace} Get with no velero.io/schedule-name or BackupScheduleClusterLabel provenance check, allowing the attacker to reference any Velero Backup object regardless of origin.

Confirmed by static triage at SHA 7f488e2e and remediation verification at HEAD 6248fd4 — root cause not addressed.