A flaw was found in the HyperShift operator. In the ReconcileCredentials function, the operator copies a user-provided kubeconfig Secret (referenced via HostedCluster spec.platform.kubevirt.credentials.infraKubeConfigSecret) verbatim into the control plane namespace without any validation or sanitization:

  for k, v := range sourceSecret.Data {
      targetSecret.Data[k] = v
  }

No exec-provider stripping, no AuthProvider validation, no InsecureSkipTLSVerify guard, and no BearerTokenFile check is performed. This allows a tenant with HostedCluster and Secret creation permissions in their namespace to inject arbitrary kubeconfig content - including exec credential plugins - into the control plane namespace where it is consumed by downstream controllers (such as CAPK).

This is a defense-in-depth failure independent of the CAPK exec-provider RCE. Even after CAPK is patched to strip exec providers, the HyperShift operator should validate kubeconfig content before copying it into the privileged control plane namespace.

Identified during Red Hat ProdSec analysis of the CAPK exec-provider report (PSIRTSUPT-24794).

Source repo: https://github.com/openshift/hypershift