Read the docs
TI-2026-50175 Aliases CVE-2026-71846GHSA-wfwr-qqxc-6cch

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

Priority LOW 28CWE-250Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-250.

Summary

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0016 5th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.11—1787688993Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—1787259125Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—1786882244Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—1787238585Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—1787184541Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.17—1787227689Patch availableCNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 VendorRed Hat Affected — Fixed in 1787688993 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 VendorRed Hat Affected — Fixed in 1787259125 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 VendorRed Hat Affected — Fixed in 1786882244 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 VendorRed Hat Affected — Fixed in 1787238585 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 VendorRed Hat Affected — Fixed in 1787184541 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 VendorRed Hat Affected — Fixed in 1787227689 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 6 advisories

  • RHSA-2026:60391 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
Show 3 more Red Hat advisories
  • RHSA-2026:60389 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:60389
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:60391
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Not affected: 6 products
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71846
  2. 2026-10-03 Alias added: GHSA-wfwr-qqxc-6cch

References

Advisory 8

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2022-10313 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go… CVSS 3.1HIGH 7.5
  • TI-2026-04135 Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.1 CVSS 3.1HIGH 8.2
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences