CVE-2026-73834— Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
Quick assessment
Affected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在红帽高级集群管理（Red Hat Advanced Cluster Management for Kubernetes）的 must-gather 组件中发现了一个漏洞。某些 ACM 包装器自定义资源（Custom Resources）包含敏感的 Secret 数据，但在收集过程中未进行脱敏处理。当管理员运行 must-gather 时，凭证和令牌将以明文形式被捕获并保存在生成的归档文件中，可能导致任何能够访问该归档文件的人获取敏感信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73834
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
II. Public POCs for CVE-2026-73834
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73834
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73834 (2)
Same Patch Batch · Red Hat · 2026-08-18 · 14 CVEs total
| CVE-2026-66780 | 9.9 CRITICAL | Submariner-operator: submariner-operator: flat broker trust model grants every spoke full |
| CVE-2026-12564 | 9.6 CRITICAL | Automation-controller: automation-controller: kubernetes service account token exfiltratio |
| CVE-2026-18963 | 9.1 CRITICAL | Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentia |
| CVE-2026-66793 | 8.8 HIGH | Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary containe |
| CVE-2026-75924 | 8.7 HIGH | Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants clust |
| CVE-2026-66783 | 8.2 HIGH | Submariner-operator: submariner-operator: arbitrary image override enables privileged code |
| CVE-2026-66782 | 7.8 HIGH | Submariner-operator: submariner-operator: broker api bearer token stored cleartext in cr s |
| CVE-2026-71365 | 7.7 HIGH | Awx: webhook status callback ssrf leaks the git pat |
| CVE-2026-15571 | 7.3 HIGH | Keycloak-services: keycloak-services: predictable account-linking hash enables account tak |
| CVE-2026-66781 | 6.5 MEDIUM | Submariner-operator: submariner-operator: ipsec psk stored cleartext in submariner cr spec |
| CVE-2026-75032 | 6.3 MEDIUM | Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder |
| CVE-2026-75485 | 5.5 MEDIUM | Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of |
| CVE-2026-19608 | 5.3 MEDIUM | Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy |
IV. Related Vulnerabilities
Same product: Red Hat Advanced Cluster Management for Kubernetes 2
-
CVE-2026-73137
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-67567
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-66788
Lighthouse: lighthouse: arbitrary local-namespace injection -
CVE-2026-66787
Lighthouse: lighthouse: cross-cluster dns spoofing via unval -
CVE-2026-66785
Submariner: submariner: unvalidated endpoint.spec.subnets pr
Same vendor: Red Hat
-
CVE-2026-78367
Rpm: rpmbuild gettarspec() crafted tar member name → macro i -
CVE-2026-78376
Webkitgtk: use-after-free of jscvalue function parameters -
CVE-2026-78323
Jss: jss: jsstrustmanager does not verify nss trust flags on -
CVE-2026-73267
Clusterclaims-controller: clusterclaims-controller: managedc -
CVE-2026-73137
Multicloud-operators-subscription: multicloud-operators-subs
Same weakness: CWE-312
-
CVE-2026-59657
Apache CloudStack: Sensitive Information Disclosure via Clea -
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76386
Information Disclosure through Action Parameters in Zoom app -
CVE-2026-76384
Information Disclosure through Action Parameters in Splunk A -
CVE-2026-76385
Information Disclosure through Action Parameters in Venafi a
V. Comments for CVE-2026-73834
No comments yet