CVE-2024-5042 Submariner-operator: rbac permissions can allow for the spread of node compromises

Medium 6.6 Published 17 May 2024 Updated 13 Oct 2026

Excessive RBAC permissions allow attackers to steal service account tokens and compromise other nodes or the entire cluster.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-5042?

CVE-2024-5042 is a medium-severity vulnerability in Red Hat RHODF-4.16-RHEL-9, published on 17 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

Weakness: CWE-250

Which versions are affected by CVE-2024-5042?

9 open source packages ship an affected version, including github.com/submariner-io/submariner-operator.

Package	Affected	Fixed in
`github.com/submariner-io/submariner-operator` Go	All versions	`0.16.4`
`github.com/submariner-io/submariner-operator` Go	All versions	`0.15.4`
`github.com/submariner-io/submariner-operator` Go	All versions	`0.15.4`
`github.com/submariner-io/submariner-operator` Go	From `0.16.0-m0`	`0.16.4`
`github.com/submariner-io/submariner-operator` Go	From `0.16.0-m0`	`0.16.4`
`github.com/submariner-io/submariner-operator` Go	From `0.17.0-m0`	`0.17.2`

3 more packages

`github.com/submariner-io/submariner-operator` Go	From `0.17.0-m0`	`0.17.2`
`github.com/submariner-io/submariner-operator` Go	From `0.18.0-m0`	`0.18.0-rc0`
`github.com/submariner-io/submariner-operator` Go	From `0.18.0-m0`	`0.18.0-rc0`

How do I fix CVE-2024-5042?

Upgrade github.com/submariner-io/submariner-operator to a fixed version for your release line: 0.16.4, 0.15.4, 0.17.2 or 0.18.0-rc0.

Is CVE-2024-5042 being exploited?

There is no known exploitation of CVE-2024-5042 in the wild and no public exploit code.

Sources

Also known as GHSA-2rhx-qhxp-5jpw, GO-2024-2866.