EUVD-2026-57688
GHSA-wfwr-qqxc-6cch
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local vector because pod execution or token theft is required; PR:L reflects the ServiceAccount's low-privilege starting point; S:C and C:H capture cross-namespace Secret read impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
AnalysisAI
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. If the insights-client pod is breached, an attacker can read every Secret across the hub cluster - including managed-cluster kubeconfigs - enabling lateral movement to downstream managed clusters. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Technical ContextAI
insights-client is a telemetry and monitoring component deployed as part of Red Hat Advanced Cluster Management for Kubernetes 2 (CPE: cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*:*:*:*:*:*:*:*). In Kubernetes, components are assigned ServiceAccounts bound to Roles or ClusterRoles via RBAC. This component's ClusterRole grants secrets/get, secrets/list, and secrets/watch at the cluster scope (not namespace-scoped), violating the principle of least privilege. CWE-250 (Execution with Unnecessary Privileges) is the root cause - the code only consumes a single named Secret but the RBAC definition grants unrestricted read access to all Secrets in all namespaces on the hub cluster. In ACM environments, hub-cluster Secrets routinely contain kubeconfig credentials for every managed cluster, making the blast radius of a ServiceAccount token compromise disproportionately large.
RemediationAI
The primary remediation is to apply a Red Hat-issued patch for Red Hat ACM 2 once available; monitor https://access.redhat.com/security/cve/CVE-2026-71846 for the specific fixed release version, which was not confirmed in the provided input data. As a compensating control prior to patching, administrators should manually edit the insights-client ClusterRole to restrict its Secret access to only the specific named Secret the component requires, replacing the broad cluster-wide wildcard grant with a targeted ResourceName constraint - this limits the blast radius of pod compromise without disrupting component functionality, though it may require re-testing the component against the narrowed scope. Additionally, enable Kubernetes audit logging on secrets/get and secrets/list operations and alert on any access from the insights-client ServiceAccount beyond the expected single Secret, which would surface token abuse early. If the cluster supports OPA/Gatekeeper or Kyverno policies, enforce a least-privilege RBAC policy that blocks ClusterRoles from granting cluster-wide Secret read unless explicitly exempted.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bund
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today