CVE-2024-5042
Submariner-operator: rbac permissions can allow for the spread of node compromises
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Submariner-operator: rbac permissions can allow for the spread of node compromises
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
- Record
CVE-2024-5042- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-250
- Updated
- 2026-11-02
EUVDEUVD-2024-1367
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
- Record
EUVD-2024-1367- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2rhx-qhxp-5jpw
Submariner Operator sets unnecessary RBAC permissions
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
- Record
GHSA-2rhx-qhxp-5jpw- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-250
- Updated
- 2026-11-02
NVD
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
- Record
CVE-2024-5042- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-250
- Updated
- 2026-11-02
OSV
Submariner-operator: rbac permissions can allow for the spread of node compromises
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
- Record
CVE-2024-5042- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-250
- Updated
- 2026-11-02
OSVGHSA-2rhx-qhxp-5jpw
Submariner Operator sets unnecessary RBAC permissions
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
- Record
GHSA-2rhx-qhxp-5jpw- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N - Weakness
- CWE-250
- Updated
- 2026-11-02
OSVGO-2024-2866 No score
Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator
Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator
- Record
GO-2024-2866- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/submariner-io/submariner-operatorGo |
0.16.0-m0 up to 0.16.4 | 0.16.4 |
github.com/submariner-io/submariner-operatorGo |
0.17.0-m0 up to 0.17.2 | 0.17.2 |
github.com/submariner-io/submariner-operatorGo |
before 0.15.4 | 0.15.4 |
github.com/submariner-io/submariner-operatorGo |
0.18.0-m0 up to 0.18.0-rc0 | 0.18.0-rc0 |
github.com/submariner-io/submariner-operatorGo |
before 0.16.4, 0.17.0 and later | 0.16.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-5042 is a medium vulnerability (CVSS 6.6) in Red Hat Advanced Cluster Management For Kubernetes 2, published May 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in github.com/submariner-io/submariner-operator 0.16.4.
References
access.redhat.com/errata/RHSA-2024:4591
bugzilla.redhat.com/show_bug.cgi?id=2280921
github.com/advisories/GHSA-2rhx-qhxp-5jpw
nvd.nist.gov/vuln/detail/CVE-2024-5042
Show 10 moreShow less
catalog.redhat.com/software/containers