Cluster-monitoring-operator: credentials leak

Summary

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.

Timeline

1. Apr 25, 2024, 4:25 PM UTCCVE published
2. Apr 26, 2024, 2:01 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 8, 2026, 11:57 AM UTCRecord last updated

Affected versions

• cluster-monitoring-operator

  through 0.1.1

• openshift4/ose-cluster-monitoring-operator

  Version range not reported

• openshift4/ose-cluster-monitoring-operator

  Version range not reported

• openshift4/cloud-network-config-controller-rhel8

  Version range not reported

• openshift4/driver-toolkit-rhel9

  Version range not reported

• openshift4/egress-router-cni-rhel8

  Version range not reported

• openshift4/kubevirt-csi-driver-rhel8

  Version range not reported

• openshift4/network-tools-rhel8

  Version range not reported

• openshift4/oc-mirror-plugin-rhel8

  Version range not reported

• openshift4/openshift-route-controller-manager-rhel8

  Version range not reported

• openshift4/ose-agent-installer-api-server-rhel8

  Version range not reported

• openshift4/ose-agent-installer-csr-approver-rhel8

  Version range not reported

• openshift4/ose-agent-installer-node-agent-rhel9

  Version range not reported

• openshift4/ose-agent-installer-orchestrator-rhel8

  Version range not reported

• openshift4/ose-agent-installer-utils-rhel9

  Version range not reported

• openshift4/ose-alibaba-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-alibaba-cloud-csi-driver-container-rhel8

  Version range not reported

• openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8

  Version range not reported

• openshift4/ose-alibaba-machine-controllers-rhel8

  Version range not reported

• openshift4/ose-apiserver-network-proxy-rhel8

  Version range not reported

• openshift4/ose-aws-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-aws-cluster-api-controllers-rhel8

  Version range not reported

• openshift4/ose-aws-ebs-csi-driver-rhel8

  Version range not reported

• openshift4/ose-aws-ebs-csi-driver-rhel8-operator

  Version range not reported

• openshift4/ose-aws-pod-identity-webhook-rhel8

  Version range not reported

• openshift4/ose-azure-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-azure-cloud-node-manager-rhel8

  Version range not reported

• openshift4/ose-azure-cluster-api-controllers-rhel8

  Version range not reported

• openshift4/ose-azure-disk-csi-driver-rhel8

  Version range not reported

• openshift4/ose-azure-disk-csi-driver-rhel8-operator

  Version range not reported

• openshift4/ose-azure-file-csi-driver-operator-rhel8

  Version range not reported

• openshift4/ose-azure-file-csi-driver-rhel8

  Version range not reported

• openshift4/ose-azure-workload-identity-webhook-rhel8

  Version range not reported

• openshift4/ose-baremetal-installer-rhel8

  Version range not reported

• openshift4/ose-baremetal-machine-controllers

  Version range not reported

• openshift4/ose-baremetal-rhel8-operator

  Version range not reported

• openshift4/ose-baremetal-runtimecfg-rhel8

  Version range not reported

• openshift4/ose-cli

  Version range not reported

• openshift4/ose-cli-artifacts

  Version range not reported

• openshift4/ose-cloud-credential-operator

  Version range not reported

• openshift4/ose-cluster-api-rhel8

  Version range not reported

• openshift4/ose-cluster-authentication-operator

  Version range not reported

• openshift4/ose-cluster-autoscaler

  Version range not reported

• openshift4/ose-cluster-autoscaler-operator

  Version range not reported

• openshift4/ose-cluster-baremetal-operator-rhel8

  Version range not reported

• openshift4/ose-cluster-bootstrap

  Version range not reported

• openshift4/ose-cluster-capi-operator-container-rhel8

  Version range not reported

• openshift4/ose-cluster-capi-rhel8-operator

  Version range not reported

• openshift4/ose-cluster-cloud-controller-manager-operator-rhel8

  Version range not reported

• openshift4/ose-cluster-config-operator

  Version range not reported

• openshift4/ose-cluster-control-plane-machine-set-operator-rhel8

  Version range not reported

• openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator

  Version range not reported

• openshift4/ose-cluster-dns-operator

  Version range not reported

• openshift4/ose-cluster-etcd-rhel8-operator

  Version range not reported

• openshift4/ose-cluster-image-registry-operator

  Version range not reported

• openshift4/ose-cluster-ingress-operator

  Version range not reported

• openshift4/ose-cluster-kube-apiserver-operator

  Version range not reported

• openshift4/ose-cluster-kube-cluster-api-rhel8-operator

  Version range not reported

• openshift4/ose-cluster-kube-controller-manager-operator

  Version range not reported

• openshift4/ose-cluster-kube-scheduler-operator

  Version range not reported

• openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator

  Version range not reported

• openshift4/ose-cluster-machine-approver

  Version range not reported

• openshift4/ose-cluster-monitoring-operator

  Version range not reported

• openshift4/ose-cluster-network-operator

  Version range not reported

• openshift4/ose-cluster-node-tuning-operator

  Version range not reported

• openshift4/ose-cluster-node-tuning-rhel9-operator

  Version range not reported

• openshift4/ose-cluster-olm-operator-rhel8

  Version range not reported

• openshift4/ose-cluster-openshift-apiserver-operator

  Version range not reported

• openshift4/ose-cluster-openshift-controller-manager-operator

  Version range not reported

• openshift4/ose-cluster-platform-operators-manager-rhel8

  Version range not reported

• openshift4/ose-cluster-policy-controller-rhel8

  Version range not reported

• openshift4/ose-cluster-samples-operator

  Version range not reported

• openshift4/ose-cluster-storage-operator

  Version range not reported

• openshift4/ose-cluster-version-operator

  Version range not reported

• openshift4/ose-configmap-reloader

  Version range not reported

• openshift4/ose-console

  Version range not reported

• openshift4/ose-console-operator

  Version range not reported

• openshift4/ose-container-networking-plugins-rhel8

  Version range not reported

• openshift4/ose-coredns

  Version range not reported

• openshift4/ose-csi-driver-manila-rhel8

  Version range not reported

• openshift4/ose-csi-driver-manila-rhel8-operator

  Version range not reported

• openshift4/ose-csi-driver-nfs-rhel8

  Version range not reported

• openshift4/ose-csi-driver-shared-resource-operator-rhel8

  Version range not reported

• openshift4/ose-csi-driver-shared-resource-rhel8

  Version range not reported

• openshift4/ose-csi-driver-shared-resource-webhook-rhel8

  Version range not reported

• openshift4/ose-csi-external-attacher

  Version range not reported

• openshift4/ose-csi-external-attacher-rhel8

  Version range not reported

• openshift4/ose-csi-external-provisioner

  Version range not reported

• openshift4/ose-csi-external-provisioner-rhel8

  Version range not reported

• openshift4/ose-csi-external-resizer

  Version range not reported

• openshift4/ose-csi-external-resizer-rhel8

  Version range not reported

• openshift4/ose-csi-external-snapshotter

  Version range not reported

• openshift4/ose-csi-external-snapshotter-rhel8

  Version range not reported

• openshift4/ose-csi-livenessprobe

  Version range not reported

• openshift4/ose-csi-livenessprobe-rhel8

  Version range not reported

• openshift4/ose-csi-node-driver-registrar

  Version range not reported

• openshift4/ose-csi-node-driver-registrar-rhel8

  Version range not reported

• openshift4/ose-csi-snapshot-controller

  Version range not reported

• openshift4/ose-csi-snapshot-controller-rhel8

  Version range not reported

• openshift4/ose-csi-snapshot-validation-webhook-rhel8

  Version range not reported

• openshift4/ose-deployer

  Version range not reported

• openshift4/ose-docker-builder

  Version range not reported

• openshift4/ose-docker-registry

  Version range not reported

• openshift4/ose-etcd-rhel9

  Version range not reported

• openshift4/ose-gcp-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-gcp-cluster-api-controllers-rhel8

  Version range not reported

• openshift4/ose-gcp-pd-csi-driver-operator-rhel8

  Version range not reported

• openshift4/ose-gcp-pd-csi-driver-rhel8

  Version range not reported

• openshift4/ose-haproxy-router

  Version range not reported

• openshift4/ose-hyperkube-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel8

  Version range not reported

• openshift4/ose-ibmcloud-cluster-api-controllers-rhel8

  Version range not reported

• openshift4/ose-ibm-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-ibmcloud-machine-controllers-rhel8

  Version range not reported

• openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8

  Version range not reported

• openshift4/ose-ibm-vpc-block-csi-driver-rhel8

  Version range not reported

• openshift4/ose-ibm-vpc-node-label-updater-rhel8

  Version range not reported

• openshift4/ose-image-customization-controller-rhel8

  Version range not reported

• openshift4/ose-insights-rhel8-operator

  Version range not reported

• openshift4/ose-installer

  Version range not reported

• openshift4/ose-installer-artifacts

  Version range not reported

• openshift4/ose-ironic-agent-rhel9

  Version range not reported

• openshift4/ose-ironic-machine-os-downloader-rhel9

  Version range not reported

• openshift4/ose-ironic-rhel9

  Version range not reported

• openshift4/ose-ironic-static-ip-manager-rhel9

  Version range not reported

• openshift4/ose-k8s-prometheus-adapter

  Version range not reported

• openshift4/ose-kube-proxy

  Version range not reported

• openshift4/ose-kube-rbac-proxy

  Version range not reported

• openshift4/ose-kube-state-metrics

  Version range not reported

• openshift4/ose-kube-storage-version-migrator-rhel8

  Version range not reported

• openshift4/ose-kubevirt-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-kuryr-cni-rhel8

  Version range not reported

• openshift4/ose-kuryr-controller-rhel8

  Version range not reported

• openshift4/ose-libvirt-machine-controllers

  Version range not reported

• openshift4/ose-machine-api-operator

  Version range not reported

• openshift4/ose-machine-api-provider-aws-rhel8

  Version range not reported

• openshift4/ose-machine-api-provider-azure-rhel8

  Version range not reported

• openshift4/ose-machine-api-provider-gcp-rhel8

  Version range not reported

• openshift4/ose-machine-api-provider-openstack-rhel8

  Version range not reported

• openshift4/ose-machine-config-operator

  Version range not reported

• openshift4/ose-machine-os-images-rhel8

  Version range not reported

• openshift4/ose-multus-admission-controller

  Version range not reported

• openshift4/ose-multus-cni

  Version range not reported

• openshift4/ose-multus-networkpolicy-rhel8

  Version range not reported

• openshift4/ose-multus-route-override-cni-rhel8

  Version range not reported

• openshift4/ose-multus-whereabouts-ipam-cni-rhel8

  Version range not reported

• openshift4/ose-must-gather

  Version range not reported

• openshift4/ose-network-interface-bond-cni-rhel8

  Version range not reported

• openshift4/ose-network-metrics-daemon-rhel8

  Version range not reported

• openshift4/ose-nutanix-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-nutanix-machine-controllers-rhel8

  Version range not reported

• openshift4/ose-oauth-apiserver-rhel8

  Version range not reported

• openshift4/ose-oauth-proxy

  Version range not reported

• openshift4/ose-oauth-server-rhel8

  Version range not reported

• openshift4/ose-olm-catalogd-rhel8

  Version range not reported

• openshift4/ose-olm-operator-controller-rhel8

  Version range not reported

• openshift4/ose-olm-rukpak-rhel8

  Version range not reported

• openshift4/ose-openshift-apiserver-rhel8

  Version range not reported

• openshift4/ose-openshift-controller-manager-rhel8

  Version range not reported

• openshift4/ose-openshift-state-metrics-rhel8

  Version range not reported

• openshift4/ose-openstack-cinder-csi-driver-rhel8

  Version range not reported

• openshift4/ose-openstack-cinder-csi-driver-rhel8-operator

  Version range not reported

• openshift4/ose-openstack-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-operator-lifecycle-manager

  Version range not reported

• openshift4/ose-operator-marketplace

  Version range not reported

• openshift4/ose-operator-registry

  Version range not reported

• openshift4/ose-ovirt-machine-controllers-rhel8

  Version range not reported

• openshift4/ose-ovn-kubernetes

  Version range not reported

• openshift4/ose-ovn-kubernetes-microshift-rhel9

  Version range not reported

• openshift4/ose-ovn-kubernetes-rhel9

  Version range not reported

• openshift4/ose-pod

  Version range not reported

• openshift4/ose-powervs-block-csi-driver-operator-rhel8

  Version range not reported

• openshift4/ose-powervs-block-csi-driver-rhel8

  Version range not reported

• openshift4/ose-powervs-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-powervs-machine-controllers-rhel8

  Version range not reported

• openshift4/ose-prometheus

  Version range not reported

• openshift4/ose-prometheus-alertmanager

  Version range not reported

• openshift4/ose-prometheus-config-reloader

  Version range not reported

• openshift4/ose-prometheus-node-exporter

  Version range not reported

• openshift4/ose-prometheus-operator

  Version range not reported

• openshift4/ose-prometheus-operator-admission-webhook-rhel8

  Version range not reported

• openshift4/ose-prom-label-proxy

  Version range not reported

• openshift4/ose-sdn-rhel8

  Version range not reported

• openshift4/ose-service-ca-operator

  Version range not reported

• openshift4/ose-telemeter

  Version range not reported

• openshift4/ose-tests

  Version range not reported

• openshift4/ose-thanos-rhel8

  Version range not reported

• openshift4/ose-tools-rhel8

  Version range not reported

• openshift4/ose-vmware-vsphere-csi-driver-operator-rhel8

  Version range not reported

• openshift4/ose-vmware-vsphere-csi-driver-rhel8

  Version range not reported

• openshift4/ose-vsphere-cloud-controller-manager-rhel8

  Version range not reported

• openshift4/ose-vsphere-cluster-api-controllers-rhel8

  Version range not reported

• openshift4/ose-vsphere-csi-driver-operator-rhel8

  Version range not reported

• openshift4/ose-vsphere-csi-driver-rhel8

  Version range not reported

• openshift4/ose-vsphere-csi-driver-syncer-rhel8

  Version range not reported

• openshift4/ose-vsphere-problem-detector-rhel8

  Version range not reported

• openshift4/ovirt-csi-driver-rhel7

  Version range not reported

• openshift4/ovirt-csi-driver-rhel8

  Version range not reported

• openshift4/ovirt-csi-driver-rhel8-operator

  Version range not reported

• openshift4/ose-cluster-monitoring-rhel9-operator

  Version range not reported

• rhacm2/endpoint-monitoring-rhel8-operator

  Version range not reported

• rhacm2/grafana-dashboard-loader-rhel8

  Version range not reported

• rhacm2/metrics-collector-rhel9

  Version range not reported

• rhacm2/multicluster-observability-rhel9-operator

  Version range not reported

• rhacm2/rbac-query-proxy-rhel8

  Version range not reported

• openshift3/ose-cluster-monitoring-operator

  Version range not reported

• github.com/openshift/cluster-monitoring-operatorGo

  through 0.1.1

• github.com/openshift/cluster-monitoring-operatorGo

  All versions

References 6