## Operator ClusterRole grants cluster-wide impersonation of users, groups, and service accounts

**CWEs:** CWE-269
**CVSS:** 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
**Component:** stolostron/multicluster-global-hub-operator-bundle

### Description
The CSV clusterPermissions grant the multicluster-global-hub-operator service account the `impersonate` verb on core `users` and `groups` (and on `serviceaccounts`) with no resourceNames scoping. Impersonation of arbitrary groups includes system:masters, which the API server treats as cluster-admin regardless of RBAC bindings. This makes the operator identity cluster-admin-equivalent by construction: the RBAC boundary provides no containment if the operator pod, its projected token, or its kubeconfig is compromised.

### Affected Locations
- `:`
- `:`

### Evidence
**clusterPermissions rule, CSV lines 696-702 — unrestricted impersonation**
```yaml
- apiGroups:
  - ""
  resources:
  - groups
  - users
  verbs:
  - impersonate
```

### Attack Pattern
An attacker who compromises the operator pod or steals its service-account token gains full hub-cluster admin by impersonating privileged users or groups.

---
*Source: Ex-Wing security assessment, finding FIND-001*