CVE-2020-25655 Missing authorization in open-cluster-management

What is CVE-2020-25655?

CVE-2020-25655 is a medium-severity missing authorization vulnerability in Red Hat open-cluster-management, published on 9 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.

Weakness: CWE-863

Which versions are affected by CVE-2020-25655?

It affects 1 product.

Products include Redhat Advanced Cluster Management for Kubernetes.

How do I fix CVE-2020-25655?

No fix has been published for CVE-2020-25655 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-25655 being exploited?

There is no known exploitation of CVE-2020-25655 in the wild and no public exploit code.

Other vulnerabilities in Red Hat open-cluster-management

• CVE-2026-4740 Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation High 8.2
• CVE-2023-3027 Privilege escalation in RHACM High 7.8
• CVE-2022-3841 Server-side request forgery in RHACM High 7.8
• CVE-2026-71474 Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response High 7.1
• CVE-2026-71475 Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fvqj-2g9g-f9xv.