EUVD-2026-60958
GHSA-8m45-79jm-xw59
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access to the archive is the attack vector; low privilege reflects non-root archive access; high confidentiality impact from reusable cluster credentials; no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.
AnalysisAI
Cleartext credential exposure in Red Hat Advanced Cluster Management for Kubernetes affects the must-gather diagnostic tool, which collects ACM wrapper Custom Resources containing embedded Secret data without scrubbing sensitive fields. Any administrator who runs must-gather to diagnose cluster issues inadvertently captures credentials and tokens in the resulting archive, which may then be stored, shared, or transmitted without awareness of the embedded secrets. No public exploit identified at time of analysis, but the information disclosure risk is compounded by the routine, trust-assumed nature of diagnostic archive handling.
Technical ContextAI
Red Hat Advanced Cluster Management for Kubernetes (ACM) extends the Kubernetes API with Custom Resource Definitions (CRDs) to manage multi-cluster lifecycle, policies, and observability. Certain ACM-specific wrapper CRDs embed Kubernetes Secret data - such as credentials and bearer tokens - directly within their spec or status fields. The must-gather tool is a standard Kubernetes diagnostic utility (oc adm must-gather) that collects cluster state, logs, and resource manifests for offline troubleshooting. ACM's must-gather wrapper collects these CRDs in full fidelity, without applying the Secret-field redaction that standard must-gather applies to core Kubernetes Secret objects. The root cause, classified as CWE-312 (Cleartext Storage of Sensitive Information), is the absence of a redaction pass over ACM-specific resource types before they are written to the archive. Affected product is identified via CPE cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*:*:*:*:*:*:*:*.
RemediationAI
Patch available per vendor advisory - administrators should consult https://access.redhat.com/security/cve/CVE-2026-73834 for the specific fixed ACM release and apply the update promptly. No exact fix version was independently confirmed in the provided intelligence data. As a compensating control prior to patching, restrict access to must-gather archives using filesystem ACLs or role-based access controls, ensuring only personnel who genuinely require the data can retrieve archives from support-ticket systems or shared storage. When sharing archives with Red Hat support, consider manually inspecting and redacting Secret-bearing Custom Resource YAML files using tools such as yq or grep before transmission - note this is error-prone and should not substitute for patching. Review any previously collected must-gather archives for exposed credentials and rotate all tokens, API keys, and credentials found within them, as these must be treated as compromised regardless of who accessed the archive.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today