CVE-2026-75485— Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials
Quick assessment
Affected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在红帽高级集群管理（Red Hat Advanced Cluster Management for Kubernetes）的 must-gather 组件中发现了一个缺陷。集群的 Proxy 对象以原始形式被导出，绕过了通常会对敏感字段进行脱敏处理的 重命名机制。这导致基本认证（basic-auth）凭据泄露在 must-gather 归档文件中，任何能够访问该归档文件的人都有可能获得这些敏感的认证信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75485
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
II. Public POCs for CVE-2026-75485
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75485
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-75485 (2)
Same Patch Batch · Red Hat · 2026-08-18 · 14 CVEs total
| CVE-2026-66780 | 9.9 CRITICAL | Submariner-operator: submariner-operator: flat broker trust model grants every spoke full |
| CVE-2026-12564 | 9.6 CRITICAL | Automation-controller: automation-controller: kubernetes service account token exfiltratio |
| CVE-2026-18963 | 9.1 CRITICAL | Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentia |
| CVE-2026-66793 | 8.8 HIGH | Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary containe |
| CVE-2026-75924 | 8.7 HIGH | Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants clust |
| CVE-2026-66783 | 8.2 HIGH | Submariner-operator: submariner-operator: arbitrary image override enables privileged code |
| CVE-2026-66782 | 7.8 HIGH | Submariner-operator: submariner-operator: broker api bearer token stored cleartext in cr s |
| CVE-2026-71365 | 7.7 HIGH | Awx: webhook status callback ssrf leaks the git pat |
| CVE-2026-15571 | 7.3 HIGH | Keycloak-services: keycloak-services: predictable account-linking hash enables account tak |
| CVE-2026-66781 | 6.5 MEDIUM | Submariner-operator: submariner-operator: ipsec psk stored cleartext in submariner cr spec |
| CVE-2026-75032 | 6.3 MEDIUM | Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder |
| CVE-2026-73834 | 5.5 MEDIUM | Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redact |
| CVE-2026-19608 | 5.3 MEDIUM | Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy |
IV. Related Vulnerabilities
Same product: Red Hat Advanced Cluster Management for Kubernetes 2
-
CVE-2026-73137
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-67567
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-66788
Lighthouse: lighthouse: arbitrary local-namespace injection -
CVE-2026-66787
Lighthouse: lighthouse: cross-cluster dns spoofing via unval -
CVE-2026-66785
Submariner: submariner: unvalidated endpoint.spec.subnets pr
Same vendor: Red Hat
-
CVE-2026-73267
Clusterclaims-controller: clusterclaims-controller: managedc -
CVE-2026-73137
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-67567
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-66788
Lighthouse: lighthouse: arbitrary local-namespace injection -
CVE-2026-66787
Lighthouse: lighthouse: cross-cluster dns spoofing via unval
Same weakness: CWE-532
-
CVE-2026-14948
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnera -
CVE-2026-76375
Information Disclosure through Environment Data Logging in A -
CVE-2026-76374
Information Disclosure through Sensitive Data Logging in AD -
CVE-2020-37267
Renovate 19.180.0 before 23.25.1 Token Leakage via Logs -
CVE-2019-25766
Renovate before 19.38.7 Credential Exposure via Go Modules
V. Comments for CVE-2026-75485
No comments yet