6.5
Moyenne
CVE-2026-71846 A flaw was found in insights-client
Description
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions non publiées | |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 1787688993 | premières → < 1787688993 | 1787688993 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259125 | premières → < 1787259125 | 1787259125 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 1786882244 | premières → < 1786882244 | 1786882244 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238585 | premières → < 1787238585 | 1787238585 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1787184541 | premières → < 1787184541 | 1787184541 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 1787227689 | premières → < 1787227689 | 1787227689 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14.0 1786882244 | premières → < 1786882244 | 1786882244 |
Références
- RHSA-2026:60386 access.redhat.com
- RHSA-2026:60387 access.redhat.com
- RHSA-2026:60388 access.redhat.com
- RHSA-2026:60389 access.redhat.com
- RHSA-2026:60390 access.redhat.com
- RHSA-2026:60391 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2512569 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Advanced Cluster Management for Kubernetes 2
Les 121 CVE de Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
Élevée
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
8.8
Élevée
CVE-2026-93685
A flaw was found in the multicluster-observability-addon
5.4
Moyenne