PT-2025-46674 · Unknown · Observability Operator

Published 2025-11-12 · Updated 2025-11-17 · CVE-2025-2843

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Observability Operator (affected versions not specified)

Description The Observability Operator creates a ServiceAccount with ClusterRole permissions when deploying a Namespace-Scoped Custom Resource called MonitorStack. This allows a Kubernetes Account with only namespaced-level roles to create a MonitorStack in an authorized namespace and then elevate permissions to the cluster level by impersonating the ServiceAccount created by the Operator. This can lead to privilege escalation and other related issues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-2843

GHSA-MJ6P-P843-X5WC

GO-2025-4125

Affected Products

Observability Operator

References · 15

• https://osv.dev/vulnerability/GHSA-mj6p-p843-x5wc · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:21146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2843 · Security Note
• https://osv.dev/vulnerability/GO-2025-4125 · Vendor Advisory
• https://github.com/rhobs/observability-operator · Note
• https://github.com/rhobs/observability-operator/releases/tag/v1.3.0 · Note
• https://github.com/rhobs/observability-operator/commit/98b927fab755decd6e030ac6af5c005879bab020 · Note
• https://access.redhat.com/security/cve/CVE-2025-2843 · Note
• https://twitter.com/CveTodo/status/1988660302687174895 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988708290675564738 · Twitter Post
• https://twitter.com/CveFindCom/status/1988754019976720540 · Twitter Post
• https://twitter.com/CVEnew/status/1988721723122815430 · Twitter Post
• https://t.me/CVEtracker/37152 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2355222 · Note
• https://github.com/advisories/GHSA-mj6p-p843-x5wc · Note