Read the docs
TI-2022-01762 Aliases CVE-2022-1902GHSA-c2p8-xm7c-wc48

Exposure of resource to wrong sphere in Red Hat Advanced Cluster Security for Kubernetes

Priority MEDIUM 41CWE-497Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-497.

Summary

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.

Why it matters now

EPSS 0.01401 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Red Hat Advanced Cluster Security for KubernetesRed Hat Advanced Cluster Security for Kubernetes 3—No fix listedCNA
  • Red Hat Advanced Cluster Security for Kubernetes Vendor— Affected Red Hat Advanced Cluster Security for Kubernetes 3 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:advanced_cluster_security:3.68:*:*:*:*:kubernates:*:*3.68VulnerableRed Hat
cpe:2.3:a:redhat:advanced_cluster_security:3.69:*:*:*:*:kubernates:*:*3.69VulnerableRed Hat
cpe:2.3:a:redhat:advanced_cluster_security:3.70:*:*:*:*:kubernates:*:*3.70VulnerableRed Hat
  • cpe:2.3:a:redhat:advanced_cluster_security:3.68:*:*:*:*:kubernates:*:* Versions 3.68 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:advanced_cluster_security:3.69:*:*:*:*:kubernates:*:* Versions 3.69 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:advanced_cluster_security:3.70:*:*:*:*:kubernates:*:* Versions 3.70 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2022:5189 Released 2022-06-27 · Red Hat rating Important
    RHACS 3.70 security update
    • RHACS 3.70 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2022:5188 Released 2022-06-24 · Red Hat rating Important
    RHACS 3.69 security update
    • RHACS 3.69 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2022:5132 Released 2022-06-20 · Red Hat rating Important
    RHACS 3.68 security update
    • RHACS 3.68 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHACS 3.68 for RHEL 8Fixed RHSA-2022:5132
RHACS 3.69 for RHEL 8Fixed RHSA-2022:5188
RHACS 3.70 for RHEL 8Fixed RHSA-2022:5189
Not affected: 3 products
  • RHACS 3.68 for RHEL 8
  • RHACS 3.69 for RHEL 8
  • RHACS 3.70 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1902
  2. 2026-10-03 Alias added: GHSA-c2p8-xm7c-wc48

References

Exploit 1

Advisory 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2024-00368 Mholt/archiver: path traversal vulnerability CVSS 3.1HIGH 7.8
  • TI-2023-04563 Stackrox: missing http security headers allows for clickjacking in web ui CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences