A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.

This flaw in the ACM must-gather tool causes the cluster Proxy object to be collected without redaction, bypassing the sanitization provided by oc inspect. Proxy basic-auth credentials are exposed in the resulting archive, which may be shared with support teams or stored externally. To mitigate the risk of credential exposure, restrict access to must-gather archives to authorized personnel only. Before sharing must-gather archives, especially with external entities, manually inspect and redact any sensitive information, including proxy basic-auth credentials, from the `cluster Proxy object` within the archive. Red Hat Advanced Cluster Management for Kubernetes 2.11 2026-08-26T00:00:00Z RHSA-2026:60387 rhacm2/acm-must-gather-rhel9:1787263322 Red Hat Advanced Cluster Management for Kubernetes 2.13 2026-08-26T00:00:00Z RHSA-2026:60390 rhacm2/acm-must-gather-rhel9:1787260453 Red Hat Advanced Cluster Management for Kubernetes 2.14 2026-08-26T00:00:00Z RHSA-2026:60388 rhacm2/acm-must-gather-rhel9:1787189811 Red Hat Advanced Cluster Management for Kubernetes 2.15 2026-08-26T00:00:00Z RHSA-2026:60389 rhacm2/acm-must-gather-rhel9:1787238730 Red Hat Advanced Cluster Management for Kubernetes 2.16 2026-08-26T00:00:00Z RHSA-2026:60391 rhacm2/acm-must-gather-rhel9:1787234748 Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-08-26T00:00:00Z RHSA-2026:60386 rhacm2/acm-must-gather-rhel9:1787228698 https://www.cve.org/CVERecord?id=CVE-2026-75485 https://nvd.nist.gov/vuln/detail/CVE-2026-75485