EUVD-2026-60958
GHSA-8m45-79jm-xw59
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access to the archive is the attack vector; low privilege reflects non-root archive access; high confidentiality impact from reusable cluster credentials; no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.
AnalysisAI
Cleartext credential exposure in Red Hat Advanced Cluster Management for Kubernetes affects the must-gather diagnostic tool, which collects ACM wrapper Custom Resources containing embedded Secret data without scrubbing sensitive fields. Any administrator who runs must-gather to diagnose cluster issues inadvertently captures credentials and tokens in the resulting archive, which may then be stored, shared, or transmitted without awareness of the embedded secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an administrator has run the ACM must-gather diagnostic against a cluster where ACM wrapper Custom Resources with embedded Secret data exist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 5.5 (Medium), reflecting that exploitation requires local access and low privileges - the attacker must obtain the must-gather archive, not exploit a remote service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who compromises a low-privileged account on the administrative workstation or gains read access to a shared storage location (ticketing system, object store, email attachment) where a must-gather archive has been deposited can extract the archive and search the YAML manifests for ACM Custom Resources containing embedded Secret fields. The cleartext credentials recovered - such as cloud provider API tokens or cluster kubeconfig credentials - can then be used to authenticate directly to the managed clusters or connected infrastructure. … |
| Remediation | Patch available per vendor advisory - administrators should consult https://access.redhat.com/security/cve/CVE-2026-73834 for the specific fixed ACM release and apply the update promptly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today