Red Hat Connectivity Link AuthPolicy Metadata Secrets Leakage Vulnerability

A vulnerability exists in the AuthPolicy metadata on Red Hat Connectivity Link, where an object intended to store secrets incorrectly assumes those secrets are already in the kuadrant-system namespace. This flaw allows a malicious actor with a developer persona to leak secrets over an HTTP connection, provided they know the names of the targeted secrets and that those secrets are limited to a single line. The vulnerability enables unauthorized access to exfiltrate secrets from the kuadrant-system namespace, which, by default, does not contain highly sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized leakage of secrets from the kuadrant-system namespace, potentially exposing sensitive information.