Read the docs
TI-2020-15672 Aliases CVE-2020-25655GHSA-fvqj-2g9g-f9xv

Incorrect authorization in Red Hat open-cluster-management

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.

Why it matters now

EPSS 0.00609 49th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatopen-cluster-management2.0.4; 2.1.0—No fix listedCNA
  • open-cluster-management VendorRed Hat Affected 2.0.4; 2.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
  • cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2020:4304 Released 2020-10-22 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management for Kubernetes version 2.0.4 images
    • Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8 rhacm2/acm-operator-bundle

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8Fixed RHSA-2020:4304

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25655
  2. 2026-10-03 Alias added: GHSA-fvqj-2g9g-f9xv

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2022-10313 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go… CVSS 3.1HIGH 7.5
  • TI-2026-04135 Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.1 CVSS 3.1HIGH 8.2
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences