EUVD-2026-57688
GHSA-wfwr-qqxc-6cch
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local vector because pod execution or token theft is required; PR:L reflects the ServiceAccount's low-privilege starting point; S:C and C:H capture cross-namespace Secret read impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
AnalysisAI
Excessive Kubernetes RBAC privileges in the insights-client ServiceAccount within Red Hat Advanced Cluster Management for Kubernetes 2 expose all cluster Secrets to any attacker who compromises the pod or obtains its token. The ServiceAccount is bound to a ClusterRole granting cluster-wide get, list, and watch on all Secrets, far exceeding the single Secret the component actually requires. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an attacker first gain execution context inside the insights-client pod or otherwise obtain its ServiceAccount token - this is the binding constraint imposed by AV:L/PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N accurately reflects the exploitability profile: local attack vector, low complexity, low privileges required, and a scope change that elevates the confidentiality impact to High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who achieves code execution inside the insights-client pod - for example via a container escape, a supply-chain compromise of the insights-client image, or injection through a telemetry data path - immediately has access to the pod's ServiceAccount token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. Using that token against the Kubernetes API server, the attacker can issue a single authenticated request to list and read all Secrets across every namespace on the hub cluster, extracting kubeconfig credentials for all managed clusters in the ACM fleet and enabling lateral movement to those environments. … |
| Remediation | The primary remediation is to apply a Red Hat-issued patch for Red Hat ACM 2 once available; monitor https://access.redhat.com/security/cve/CVE-2026-71846 for the specific fixed release version, which was not confirmed in the provided input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today