Red Hat ACS Kubernetes insights-client excessive privileges vulnerability (CVE-2026-71846)

CVE-2026-71846 Vulnerability Overview Vulnerability ID: CVE-2026-71846 Severity: Moderate CVSS v3 Score: 6.5 Publication Date: August 12, 2026 Last Modified: August 12, 2026, 11:05:11 PM UTC Scope of Impact Affected Component: insights-client Specific Impact: The ServiceAccount for insights-client is bound to a ClusterRole that grants permissions to get, list, and watch cluster-wide secrets. However, the code only requires access to a single specific secret. This excessive privilege means that if the insights-client pod or its ServiceAccount token is compromised, an attacker would be able to access all secrets in the cluster, including the kubeconfig used to manage the cluster and other sensitive credentials. Remediation Remediation Status: No specific remediation steps or patch information are provided on the page. Additional Information Description: A vulnerability was identified in insights-client. The component's ServiceAccount is bound to a ClusterRole granting permissions to get, list, and watch cluster-wide secrets. However, the code only requires access to a single specific secret. This excessive privilege means that if the insights-client pod or its ServiceAccount token is compromised, an attacker would be able to access all secrets in the cluster, including the kubeconfig used to manage the cluster and other sensitive credentials. Statement: This is a moderate vulnerability in Red Hat Advanced Cluster Management for Kubernetes. The insights-client component has been granted cluster-wide secret read permissions. Supplementary Information Extra Information: The page provides links to "Additional information" and "External references," but the specific content is not displayed.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat ACS Kubernetes insights-client excessive privileges vulnerability (CVE-2026-71846)

More from this source