CVE-2026-93017
Description
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.
spec:
serviceAccountName:"gather"
Statement
A privilege escalation risk was found in the OpenShift insights-operator. The insights-operator-gather ClusterRole grants the operator's gather ServiceAccount cluster-wide get and list access to secrets in the core API group, with no namespace or resourceNames restriction. This means the ServiceAccount has read access to every secret in every namespace in the cluster. While the operator requires access to certain cluster data for telemetry collection, the scope of secret access exceeds what is necessary for its intended function.
An attacker who gains the ability to create a pod using the gather ServiceAccount in the openshift-insights namespace could leverage this over-permissive RBAC to read all cluster secrets, including credentials, TLS certificates, and other sensitive data.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.7 | N/A | 7.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
Backfilled from source audit finding cited in comment_zero
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
