Security readout for executives and security teams
Plain-English summary
CVE-2025-2843 is a high-severity privilege escalation in Red Hat’s Cluster Observability Operator. A namespace-level Kubernetes user could trigger creation of a service account with cluster-wide permissions, then use it to gain broader control. This is most urgent for multi-tenant OpenShift or Kubernetes environments where teams or tenants can create MonitorStack resources.
Executive priority
Prioritize remediation for multi-tenant clusters and environments with delegated namespace administration. The business risk is unauthorized cluster-wide access from a lower-privileged tenant account, potentially affecting confidentiality, integrity, and availability across workloads.
Technical view
The Observability Operator creates a ServiceAccount with ClusterRole permissions when a namespace-scoped MonitorStack custom resource is deployed. A user with namespaced privileges can create that resource in an authorized namespace and impersonate the operator-created ServiceAccount, escalating from namespace scope to cluster-level permissions. CVSS is 8.8, AV:N/AC:L/PR:L/UI:N, with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is likely limited to environments running the affected Red Hat Cluster Observability Operator package/version and allowing non-admin namespace users to create namespace-scoped MonitorStack resources. Single-tenant clusters or clusters without this operator are less likely exposed based on the provided sources.
Exploitation context
Sources describe a low-complexity, authenticated privilege escalation requiring existing namespaced Kubernetes permissions. The source bundle does not indicate public exploitation, proof-of-concept availability, or inclusion in CISA KEV. Treat risk as serious in shared clusters because the escalation crosses namespace boundaries.
Researcher notes
Evidence comes from Red Hat/CVE records. The flaw is CWE-266 privilege management. The bundle names one affected Red Hat package/version and a rhobs observability-operator entry with default status unaffected. Details on fixed versions, exploit artifacts, and real-world exploitation are not present in the supplied data.
Mitigation direction
- Review RHSA-2025:21146 and apply the Red Hat-provided update or remediation.
- Restrict who can create MonitorStack resources until the fix is applied.
- Review RBAC allowing impersonation of operator-created ServiceAccounts.
- Limit tenant permissions in namespaces hosting observability resources.
- Monitor Red Hat CVE and Bugzilla pages for updated guidance.
Validation and detection
- Identify clusters running Red Hat Cluster Observability Operator 1.3.0 affected builds.
- Check whether namespace-scoped MonitorStack resources are enabled or delegated to tenants.
- Review RBAC bindings for ClusterRole grants created by the operator.
- Confirm the installed operator version matches Red Hat’s fixed advisory guidance.
- Audit recent creation of MonitorStack resources by non-cluster-admin users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-2843 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9redhatVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2025:21146CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-2843CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2355222CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.