A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the valueExpression is compiled into a regular expression without anchoring (no ^ or $ delimiters). Because Go's regexp.MatchString performs substring matching, a mapping intended to match an exact claim value instead matches any token claim that contains that value as a substring. An identity whose claim value is a superstring of the configured pattern (e.g. a branch named "main-poc" matching a mapping for "main") can exchange its third-party OIDC token for a Central access token carrying a role it was never intended to receive. The token exchange endpoint (ExchangeAuthMachineToMachineToken) is unauthenticated.