What is the CVSS score of CVE-2026-75485?

CVE-2026-75485 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Red Hat ACM CVE-2026-75485

EUVD-2026-60959 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-08-18 redhat

GHSA-28f5-gvgw-386q

Information Disclosure Kubernetes Red Hat Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

5.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local archive access requires low privilege (PR:L, AV:L); only confidentiality is impacted as proxy credentials are exposed but no data is modified or made unavailable.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:56 vuln.today

DescriptionCVE.org

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.

AnalysisAI

Credential exposure in Red Hat Advanced Cluster Management for Kubernetes 2.x allows any local user with access to a must-gather diagnostic archive to read proxy basic-auth credentials in plaintext. The must-gather component dumps the cluster Proxy object in raw form, bypassing the redaction logic that oc inspect would normally apply to sanitize sensitive fields before archiving. No public exploit code exists and this is not listed in CISA KEV, but the CVSS AV:L/PR:L vector confirms real-world exposure is bounded to archive access rather than remote exploitation.

Technical ContextAI

Must-gather is a diagnostic data-collection tool used in OpenShift and RHACM deployments to snapshot cluster state for support or troubleshooting. It is expected to invoke oc inspect, which applies field-level redaction to strip secrets and credentials before writing objects to the archive. The root cause is CWE-532 (Insertion of Sensitive Information into Log File): the cluster Proxy object - a Kubernetes API resource that may include an httpProxy or httpsProxy URL containing embedded basic-auth credentials in the form http://user:password@proxy-host - is serialized directly to the archive without invoking that redaction pipeline. Affected product scope per NVD CPE is cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*:*:*:*:*:*:*:*, covering the RHACM 2.x line.

RemediationAI

The primary fix is to apply the Red Hat errata patch for RHACM 2.x once released - monitor https://access.redhat.com/security/cve/CVE-2026-75485 and the linked Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2517905) for errata status, as no specific patched version is confirmed in the available data. As an immediate compensating control, treat all existing must-gather archives that were collected while proxy basic-auth was configured as compromised: rotate proxy credentials and audit who received copies of those archives. Restrict future must-gather archive distribution to the minimum necessary personnel and encrypt archives before sharing externally or with support. As a structural mitigation, migrate proxy authentication from basic-auth to client certificate-based authentication, which eliminates plaintext credentials from the Proxy object entirely and removes the risk class regardless of redaction behavior. No workaround exists to retroactively redact already-collected archives.