docs(buglog): record Gitea sync for bug-1958..bug-1966

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-10 10:20:18 +00:00

2.2 KiB

Raw Blame History

status

status_updated

status_note

component

severity

timestamp

last_seen

occurrences

files

bug-1958: apiserver lets any rbac:control grant create roles and extend its own role (privilege escalation)

Description

Observed: (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) Reported by the bug-1952 fix: role create/update in controllers/roles.go accepts any rbac:control scope, so a user holding rbac:control with scope self can add cluster:control (or any permission) to a role it already holds: the same escalation bug-1952 closed for user-role assignment, by another route.

Expected: Creating roles or changing a role's permissions requires rbac:control with scope all (as user-role changes do since bug-1952). Impact: Security: privilege escalation through role editing. Found by: follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)

Environment

OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
Build: asan (xce.build)
Code: scheduler-framework @ 19be145d-dirty
Deployment: any (found by source reading; confirmed by the RED test of the fix)

Reproduction

Give user mallory a role with rbac:control scoped self.
As mallory, add cluster:control (domain all) to that role through the roles API; it is accepted.

Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
Evidence: the code sites quoted in Description; no logs kept.

Root cause

TODO: required for fixed/partial

Fix