6.5Medium
CVE-2026-71846Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege
Description
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
Weakness (CWE):
CWE-250
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| acm | 2.11 | — | |
| acm | 2.13 | — | |
| acm | 2.14 | — | |
| acm | 2.15 | — | |
| acm | 2.16 | — | |
| acm | 2.17 | — | |
| redhat | advanced cluster management for kubernetes | 2.0 | |
| redhat | insights-client | — | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | all versions | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | all versions |
References and patches
- RHSA-2026:60386 vendor-advisory
- RHSA-2026:60387 vendor-advisory
- RHSA-2026:60388 vendor-advisory
- RHSA-2026:60389 vendor-advisory
- RHSA-2026:60390 vendor-advisory
- RHSA-2026:60391 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-71846 vdb-entryVendor Advisory
- RHBZ#2512569 issue-trackingIssue TrackingVendor Advisory
CPE matches (NVD) (2)
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:*