Vulnerability · Published Nov 12, 2025 · Assigned by redhat
CVE-2025-2843Observability-operator: observability operator privilege escalation
High 8.8
In plain English
A high-severity security flaw in Cluster Observability Operator 1.3.1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rhobs/observability-operator | 1.3.0 | GHSA-mj6p-p843-x5wc |
| Go | github.com/rhobs/observability-operator | 1.3.0 | GO-2025-4125 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rhobs | observability-operator | 0 – before 1.3.0 |
| Red Hat | Cluster Observability Operator 1.3.1 | see references |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2025:21146 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-2843 vdb-entry, x_refsource_REDHAT
- RHBZ#2355222 issue-tracking, x_refsource_REDHAT