Cluster Observability Operator 1.3.1 vulnerabilities

1 known vulnerability in Cluster Observability Operator 1.3.1 from Red Hat. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  observability-operator: Incorrect Privilege Assignment

  CVE-2025-2843Nov 12, 2025Rhobs

  A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level role