{"id":"GHSA-2rhx-qhxp-5jpw","revision":"6519f627c93b4253a7f5a8b3070ee90a","records":[{"revision":"6519f627c93b4253a7f5a8b3070ee90a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2rhx-qhxp-5jpw","aliases":["CVE-2024-5042","GO-2024-2866"],"title":"Submariner Operator sets unnecessary RBAC permissions","description":"A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.","state":0,"publishedAt":"2024-05-17T15:31:10+00:00","modifiedAt":"2026-04-06T17:37:48.452964+00:00","affected":[{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.16.0-m0"},{"kind":"fixed","version":"0.16.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.17.0-m0"},{"kind":"fixed","version":"0.17.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.15.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/submariner-io/submariner-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.18.0-m0"},{"kind":"fixed","version":"0.18.0-rc0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-5042","https://github.com/submariner-io/submariner-operator/issues/3041","https://github.com/submariner-io/submariner-operator/pull/3040","https://github.com/submariner-io/submariner-operator/pull/3045","https://github.com/submariner-io/submariner-operator/pull/3046","https://github.com/submariner-io/submariner-operator/pull/3049","https://github.com/submariner-io/submariner-operator/commit/b27a04c4270e53cbff6ff8ac6245db10c204bcab","https://access.redhat.com/errata/RHSA-2024:4591","https://access.redhat.com/errata/RHSA-2026:6503","https://access.redhat.com/security/cve/CVE-2024-5042","https://bugzilla.redhat.com/show_bug.cgi?id=2280921","https://github.com/advisories/GHSA-2rhx-qhxp-5jpw","https://github.com/submariner-io/submariner-operator"],"sourceUrl":"https://github.com/advisories/GHSA-2rhx-qhxp-5jpw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2rhx-qhxp-5jpw","identifiers":["GHSA-2rhx-qhxp-5jpw","CVE-2024-5042","GO-2024-2866"]},"retained":false,"historicalAffected":[]}],"coverage":[]}