CVE-2026-71846
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS probability
- 0.12%
- CWE
- CWE-250
- Published
- 2026-08-12
- Last modified
- 2026-09-05
Affected products
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14.0
Weakness type
Related vulnerabilities
- CVE-2026-79942 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87506 — Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who...
- CVE-2026-69464 — Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-69409 — Microsoft Office SharePoint Information Disclosure Vulnerability
- CVE-2026-80238 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-83534 — PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()
- CVE-2026-72654 — Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure
- CVE-2026-76018 — Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker...