CVE-2026-71846
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
38/100
Published: 2026-08-12
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Scope Change
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Changed
C:
High
I:
None
A:
None
Description
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| redhat | advanced_cluster_management_for_kubernetes | 2.0 |
| redhat | insights-client | - |
References & Advisories (8)
Vendor Advisory
Issue Tracking
Vendor Advisory