Description
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.
Metrics
CVSS 3.1 5.5/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | — |
References
- https://access.redhat.com/errata/RHSA-2026:60386
- https://access.redhat.com/errata/RHSA-2026:60387
- https://access.redhat.com/errata/RHSA-2026:60388
- https://access.redhat.com/errata/RHSA-2026:60389
- https://access.redhat.com/errata/RHSA-2026:60390
- https://access.redhat.com/errata/RHSA-2026:60391
- https://access.redhat.com/security/cve/CVE-2026-73834
- https://bugzilla.redhat.com/show_bug.cgi?id=2517904
Timeline
- Published
- Aug 18, 2026
- Last modified
- Sep 5, 2026
- NVD status
- Awaiting Analysis