EUVD-2026-60959
GHSA-28f5-gvgw-386q
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local archive access requires low privilege (PR:L, AV:L); only confidentiality is impacted as proxy credentials are exposed but no data is modified or made unavailable.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.
AnalysisAI
Credential exposure in Red Hat Advanced Cluster Management for Kubernetes 2.x allows any local user with access to a must-gather diagnostic archive to read proxy basic-auth credentials in plaintext. The must-gather component dumps the cluster Proxy object in raw form, bypassing the redaction logic that oc inspect would normally apply to sanitize sensitive fields before archiving. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must all be true for exploitation: (1) the cluster Proxy object is configured with HTTP or HTTPS proxy basic-auth credentials embedded in the proxy URL (e.g., http://user:password@proxy.corp.example.com) - this is a non-default configuration; clusters using unauthenticated proxies or certificate-based proxy auth are not affected; (2) a must-gather collection has been executed and the resulting archive file exists; and (3) the attacker has local filesystem read access to that archive (CVSS PR:L), which may be granted via shared storage, support ticket upload, or internal file share. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.5 Medium rating with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the attack surface: exploitation is strictly local and requires low-privilege filesystem access to the archive, not network access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged cluster operator or support engineer runs must-gather to collect diagnostics and the resulting archive is uploaded to a Red Hat support case or shared via an internal ticket system. A second party with access to that archive - such as a contractor, support vendor, or insider - extracts the archive, locates the raw Proxy object file, and reads the embedded basic-auth credentials. … |
| Remediation | The primary fix is to apply the Red Hat errata patch for RHACM 2.x once released - monitor https://access.redhat.com/security/cve/CVE-2026-75485 and the linked Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2517905) for errata status, as no specific patched version is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today