Skip to content
fr Sign in
7.7 High

CVE-2026-93017 The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core…

Description

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Container Platform 4.20 1791625576 earliest → < 1791625576 1791625576
Red Hat OpenShift Container Platform 4.21 1791980436 earliest → < 1791980436 1791980436
Red Hat OpenShift Container Platform 4.19 1791626249 earliest → < 1791626249 1791626249
Red Hat OpenShift Container Platform 4.14 1791842870 earliest → < 1791842870 1791842870
Red Hat OpenShift Container Platform 4.15 1791632611 earliest → < 1791632611 1791632611
Red Hat OpenShift Container Platform 4.12 1792974936 earliest → < 1792974936 1792974936
Red Hat OpenShift Container Platform 4.16 1792879727 earliest → < 1792879727 1792879727
Red Hat OpenShift Container Platform 4.18 1792874579 earliest → < 1792874579 1792874579
Show the 2 other branches
Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4.22 1792771251 earliest → < 1792771251 1792771251
Red Hat OpenShift Container Platform 5 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift Container Platform 4

The 629 CVEs of Red Hat OpenShift Container Platform 4 →
CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 7.1 High CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service 6.5 Medium CVE-2026-120830 Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure 7.4 High CVE-2026-120194 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 High
Track this CVE