{"id":"CVE-2024-5042","aliases":["EUVD-2024-1367","GHSA-2rhx-qhxp-5jpw","GO-2024-2866"],"status":"published","title":"Submariner-operator: rbac permissions can allow for the spread of node compromises","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00507,"percentile":0.4376,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-250"],"published":"2024-05-17T13:12:00Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","fixed_in":["0.16.4","0.17.2","0.15.4","0.18.0-rc0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.0-m0"},{"fixed":"0.16.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.17.0-m0"},{"fixed":"0.17.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0-m0"},{"fixed":"0.18.0-rc0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0.16.0-m0"},{"fixed":"0.16.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0.17.0-m0"},{"fixed":"0.17.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.15.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0-m0"},{"fixed":"0.18.0-rc0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.16.4"},{"introduced":"0.17.0"}]}]}],"products":[{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat openshift data foundation 4.20"},{"vendor":"red hat","product":"rhodf-4.16-rhel-9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:4591","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6503","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5042","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2280921","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report","web"]},{"url":"https://github.com/advisories/GHSA-2rhx-qhxp-5jpw","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5042","tags":["advisory"]},{"url":"https://github.com/submariner-io/submariner-operator/issues/3041","tags":["web","report"]},{"url":"https://github.com/submariner-io/submariner-operator/pull/3040","tags":["web","fix"]},{"url":"https://github.com/submariner-io/submariner-operator/commit/b27a04c4270e53cbff6ff8ac6245db10c204bcab","tags":["web","fix"]},{"url":"https://github.com/submariner-io/submariner-operator/pull/3045","tags":["web"]},{"url":"https://github.com/submariner-io/submariner-operator/pull/3046","tags":["web"]},{"url":"https://github.com/submariner-io/submariner-operator/pull/3049","tags":["web"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5042.json","tags":["advisory"]},{"url":"https://github.com/submariner-io/submariner-operator","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-5042","title":"Submariner-operator: rbac permissions can allow for the spread of node compromises","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","status":"published","published":"2024-05-17T13:12:00.551Z","modified":"2026-10-13T23:25:13.388Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:34:00.929382Z"}],"euvd":[{"id":"EUVD-2024-1367","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","status":"published","published":"2024-05-17T13:12:00Z","modified":"2026-10-13T23:25:13Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:18.393051Z"}],"ghsa":[{"id":"GHSA-2rhx-qhxp-5jpw","title":"Submariner Operator sets unnecessary RBAC permissions","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","status":"published","published":"2024-05-17T15:31:10Z","modified":"2026-04-06T17:19:56Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:39:48.966685Z"}],"nvd":[{"id":"CVE-2024-5042","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","status":"published","published":"2024-05-17T14:15:21.123Z","modified":"2026-10-14T00:17:12.47Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:09:59.094954Z"}],"osv":[{"id":"CVE-2024-5042","title":"Submariner-operator: rbac permissions can allow for the spread of node compromises","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","status":"published","published":"2024-05-17T13:12:00.551Z","modified":"2026-10-28T02:31:10.113067435Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-2rhx-qhxp-5jpw","title":"Submariner Operator sets unnecessary RBAC permissions","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","status":"published","published":"2024-05-17T15:31:10Z","modified":"2026-04-06T17:37:48.452964Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GO-2024-2866","title":"Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator","description":"Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator","status":"published","published":"2024-06-05T15:10:42Z","modified":"2026-03-03T04:55:23.963223Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}