Listen to this Post
The CVE-2025-XXXX vulnerability in MARIN3R’s DiscoveryServiceCertificate resource allows a privilege escalation by bypassing Kubernetes RBAC. When a user creates a DiscoveryServiceCertificate in a namespace where they have permissions, the MARIN3R operator, which runs with elevated cluster-level privileges, processes this request. The operator’s logic incorrectly fetches the TLS CA certificate secret referenced in the `spec.certificateRequest.issuerRef` field without properly validating if the user is authorized to access secrets in the namespace where that CA secret resides. This allows an attacker to craft a DiscoveryServiceCertificate that points to a CA secret in a different, unauthorized namespace. The operator, acting on behalf of the user, retrieves the targeted secret, and its contents are then embedded into the status of the created DiscoveryServiceCertificate resource, which the attacker can read, thus exfiltrating sensitive secret data across namespace boundaries.
Platform: Kubernetes Operator
Version: <0.13.4
Vulnerability: RBAC Bypass
Severity: High
date: 2025-11-04
Prediction: Patch 2025-11-11
What Undercode Say:
kubectl get discoveryServiceCertificate -o yaml | grep -A 5 "caCertificate" kubectl auth can-i create discoveryServiceCertificate --namespace=test kubectl get secrets -n kube-system
cert.Spec.CertificateRequest.IssuerRef.Name = "target-secret" cert.Spec.CertificateRequest.IssuerRef.Namespace = "kube-system"
How Exploit:
Create DiscoveryServiceCertificate referencing cross-namespace CA secret. Read the certificate status to exfiltrate the secret data.
Protection from this CVE
Upgrade MARIN3R operator to version v0.13.4. Restrict `create` permissions on DiscoveryServiceCertificate resources to trusted administrators only. Implement Kubernetes admission controllers to validate `issuerRef` namespace.
Impact:
Unauthorized secret disclosure across any namespace. Complete bypass of Kubernetes RBAC controls, leading to potential cluster-wide secret compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
