{"id":"EUVD-2025-131920","revision":"f22142550f2b4cc4a700bac3330a59f9","records":[{"revision":"f22142550f2b4cc4a700bac3330a59f9","observedAt":"2026-10-27T21:56:16.424+00:00","statement":{"source":"euvd","id":"EUVD-2025-131920","aliases":["CVE-2025-2843","GHSA-mj6p-p843-x5wc"],"title":"A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only n…","description":"A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":null}],"references":["https://access.redhat.com/errata/RHSA-2025:21146","https://access.redhat.com/security/cve/CVE-2025-2843","https://bugzilla.redhat.com/show_bug.cgi?id=2355222"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-131920","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 12, 2025, 4:36:04 PM","dateUpdated":"Sep 21, 2026, 4:03:43 PM"},"relatedAdvisories":[{"id":"RHSA-2025:21146","title":"Red Hat Security Advisory: Cluster Observability Operator 1.3.0","vulnerabilityIds":["CVE-2025-2843","CVE-2025-7783"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-131920","identifiers":["EUVD-2025-131920","CVE-2025-2843","GHSA-mj6p-p843-x5wc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}