{"id":"GHSA-2rhx-qhxp-5jpw","revision":null,"records":[{"revision":"e6429c7017414f5f95d785bd8996326e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-5042","aliases":[],"title":"Submariner-operator: rbac permissions can allow for the spread of node compromises","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","state":0,"publishedAt":"2024-05-17T13:12:00.551+00:00","modifiedAt":"2026-10-13T23:25:13.388+00:00","affected":[{"ecosystem":"https://github.com/submariner-io/submariner-operator","name":"submariner-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.14.9\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.15.0\",\n                            \"lessThan\": \"0.15.5\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.16.0\",\n                            \"lessThan\": \"0.16.7\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.17.0\",\n                            \"lessThan\": \"0.17.2\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.18.0-m0\",\n                            \"lessThan\": \"0.18.0-rc0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"packageName\": \"submariner-operator\",\n                    \"collectionURL\": \"https://github.com/submariner-io/submariner-operator\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-multicluster-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"RHODF-4.16-RHEL-9\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-multicluster-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"v4.16.0-19\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.16::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/cephcsi-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/cephcsi-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774540992\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/cephcsi-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/cephcsi-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774540668\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/mcg-core-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/mcg-core-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541259\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/mcg-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/mcg-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541345\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/ocs-client-console-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/ocs-client-console-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541880\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/ocs-client-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/ocs-client-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541518\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/ocs-metrics-exporter-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/ocs-metrics-exporter-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541420\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/ocs-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/ocs-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541448\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-cli-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-cli-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541663\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-cloudnative-pg-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-cloudnative-pg-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541469\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-console-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-console-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774542075\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-cosi-sidecar-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-cosi-sidecar-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541617\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-csi-addons-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-csi-addons-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541614\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-csi-addons-sidecar-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-csi-addons-sidecar-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541633\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-external-snapshotter-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-external-snapshotter-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541625\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-external-snapshotter-sidecar-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-external-snapshotter-sidecar-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541625\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-multicluster-console-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-multicluster-console-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774542179\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-multicluster-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-multicluster-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541779\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-must-gather-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-must-gather-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541857\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odf-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odf-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541919\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/odr-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/odr-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774541919\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"odf4/rook-ceph-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Openshift Data Foundation 4.20\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"odf4/rook-ceph-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1774542101\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/lighthouse-agent-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/lighthouse-agent-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/lighthouse-coredns-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/lighthouse-coredns-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/submariner-gateway-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/submariner-gateway-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/submariner-globalnet-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/submariner-globalnet-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/submariner-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/submariner-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/submariner-route-agent-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/submariner-route-agent-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","score":6.6,"severity":"MEDIUM"}],"references":["https://access.redhat.com/errata/RHSA-2024:4591","https://access.redhat.com/errata/RHSA-2026:6503","https://access.redhat.com/security/cve/CVE-2024-5042","https://bugzilla.redhat.com/show_bug.cgi?id=2280921","https://github.com/advisories/GHSA-2rhx-qhxp-5jpw"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-5042","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-5042","identifiers":["CVE-2024-5042"]},"retained":false,"historicalAffected":[]},{"revision":"0ff0730fd9734b91a9770e0a185db03e","observedAt":"2026-11-09T01:08:24.021+00:00","statement":{"source":"euvd","id":"EUVD-2024-1367","aliases":["CVE-2024-5042","GHSA-2rhx-qhxp-5jpw"],"title":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise o…","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","score":6.6,"severity":null}],"references":["https://access.redhat.com/errata/RHSA-2024:4591","https://access.redhat.com/errata/RHSA-2026:6503","https://access.redhat.com/security/cve/CVE-2024-5042","https://bugzilla.redhat.com/show_bug.cgi?id=2280921","https://github.com/advisories/GHSA-2rhx-qhxp-5jpw"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1367","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 17, 2024, 1:12:00 PM","dateUpdated":"Oct 13, 2026, 11:25:13 PM"},"relatedAdvisories":[{"id":"RHSA-2026:6503","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.9 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2024-5042","CVE-2025-22870","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181"]},{"id":"RHSA-2024:4591","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2023-43646","CVE-2023-47108","CVE-2024-1394","CVE-2024-5042","CVE-2024-24783","CVE-2024-24785","CVE-2024-24786","CVE-2024-28176","CVE-2024-28180","CVE-2024-28863","CVE-2024-37890"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-1367","identifiers":["EUVD-2024-1367","CVE-2024-5042","GHSA-2rhx-qhxp-5jpw"]},"retained":false,"historicalAffected":[]},{"revision":"64ed91952e0b43459ed9db241bf2a4f2","observedAt":"2026-10-25T01:17:12.119+00:00","statement":{"source":"nvd","id":"CVE-2024-5042","aliases":[],"title":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise o…","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","state":0,"publishedAt":"2024-05-17T14:15:21.123+00:00","modifiedAt":"2026-10-14T00:17:12.47+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · secalert@redhat.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","score":6.6,"severity":"MEDIUM"}],"references":["https://access.redhat.com/errata/RHSA-2024:4591","https://access.redhat.com/errata/RHSA-2026:6503","https://access.redhat.com/security/cve/CVE-2024-5042","https://bugzilla.redhat.com/show_bug.cgi?id=2280921","https://github.com/advisories/GHSA-2rhx-qhxp-5jpw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-5042","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-250"],"productCriteria":[],"sourceDates":{"published":"2024-05-17T14:15:21.123","lastModified":"2026-10-14T00:17:12.470"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-5042","identifiers":["CVE-2024-5042"]},"retained":false,"historicalAffected":[]},{"revision":"6519f627c93b4253a7f5a8b3070ee90a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2rhx-qhxp-5jpw","aliases":["CVE-2024-5042","GO-2024-2866"],"title":"Submariner Operator sets unnecessary RBAC permissions","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","state":0,"publishedAt":"2024-05-17T15:31:10+00:00","modifiedAt":"2026-04-06T17:37:48.452964+00:00","affected":[{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.16.0-m0"},{"kind":"fixed","version":"0.16.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.17.0-m0"},{"kind":"fixed","version":"0.17.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.15.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.18.0-m0"},{"kind":"fixed","version":"0.18.0-rc0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-5042","https://github.com/submariner-io/submariner-operator/issues/3041","https://github.com/submariner-io/submariner-operator/pull/3040","https://github.com/submariner-io/submariner-operator/pull/3045","https://github.com/submariner-io/submariner-operator/pull/3046","https://github.com/submariner-io/submariner-operator/pull/3049","https://github.com/submariner-io/submariner-operator/commit/b27a04c4270e53cbff6ff8ac6245db10c204bcab","https://access.redhat.com/errata/RHSA-2024:4591","https://access.redhat.com/errata/RHSA-2026:6503","https://access.redhat.com/security/cve/CVE-2024-5042","https://bugzilla.redhat.com/show_bug.cgi?id=2280921","https://github.com/advisories/GHSA-2rhx-qhxp-5jpw","https://github.com/submariner-io/submariner-operator"],"sourceUrl":"https://github.com/advisories/GHSA-2rhx-qhxp-5jpw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2rhx-qhxp-5jpw","identifiers":["GHSA-2rhx-qhxp-5jpw","CVE-2024-5042","GO-2024-2866"]},"retained":false,"historicalAffected":[]},{"revision":"ec23e694f210404b9d2f7e6a87dd9fb1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2024-2866","aliases":["CVE-2024-5042","GHSA-2rhx-qhxp-5jpw"],"title":"Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator","description":"Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator","state":0,"publishedAt":"2024-06-05T15:10:42+00:00","modifiedAt":"2026-03-03T04:55:23.963223+00:00","affected":[{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.16.4"},{"kind":"introduced","version":"0.17.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-2rhx-qhxp-5jpw","https://nvd.nist.gov/vuln/detail/CVE-2024-5042","https://github.com/submariner-io/submariner-operator/commit/b27a04c4270e53cbff6ff8ac6245db10c204bcab","https://github.com/submariner-io/submariner-operator/pull/3040","https://github.com/submariner-io/submariner-operator/issues/3041","https://access.redhat.com/errata/RHSA-2024:4591","https://access.redhat.com/security/cve/CVE-2024-5042","https://bugzilla.redhat.com/show_bug.cgi?id=2280921"],"sourceUrl":"https://osv.dev/vulnerability/GO-2024-2866","license":"OSV · upstream source license applies","key":"osv:GO-2024-2866","identifiers":["GO-2024-2866","CVE-2024-5042","GHSA-2rhx-qhxp-5jpw"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T06:04:36.9417469+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T06:04:36.9417469+00:00","lastSuccessAt":"2026-11-10T06:04:37.1495753+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:37.1495759+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-f6cc9b12cdb581c8c26d0d42311ec22aefb7992e88ee12bd79a0c89f476e29ff","complete":true,"records":421887,"lastAttemptAt":"2026-11-10T06:02:15.6675427+00:00","lastSuccessAt":"2026-11-10T06:02:15.5673353+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:02:15.6675427+00:00","snapshotPublishedAt":"2026-11-10T05:23:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T06:05:35.0354037+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T06:04:36.9417469+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T06:04:36.9417469+00:00","lastSuccessAt":"2026-11-10T06:04:37.1503787+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:37.1503789+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dcb6f23f313c40328d8b679af29a76c8","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T06:05:02.8914576+00:00","lastSuccessAt":"2026-11-10T06:05:02.887+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T06:05:02.887+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T06:04:29.7401591+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:29.7401591+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T06:02:15.7348582+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:02:15.7348582+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-14f555fdbdce5e9103ab1251a692b612ea1fcd0b3d538af6015a071f4b299249","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T06:04:36.8991666+00:00","lastSuccessAt":"2026-11-10T06:04:36.7449268+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:36.8991666+00:00","snapshotPublishedAt":"2026-11-10T05:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5b9134a1c92c7f3c542fa77c730904ae6f13b772cb6b6707fc58983c93af0933","complete":true,"records":231596,"lastAttemptAt":"2026-11-10T06:04:29.6144485+00:00","lastSuccessAt":"2026-11-10T06:04:28.0373789+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:29.6144485+00:00","snapshotPublishedAt":"2026-11-10T05:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}