Bug 2512569 (CVE-2026-71846) - CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
Summary: CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole g...
Keywords:
Status: NEW
Alias: CVE-2026-71846
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-07 16:55 UTC by OSIDB Bzimport
Modified: 2026-08-12 20:45 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-07 16:55:33 UTC 
The insights-client ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get/list/watch. The code only requires access to a single Secret — openshift-config/pull-secret (pkg/retriever/reportretriever.go:111-112, StartTokenRefresh). The over-broad RBAC means a compromise of the insights-client pod or ServiceAccount token grants read access to every Secret on the hub cluster, including managed-cluster kubeconfigs, ArgoCD/GitOps credentials, and other addon tokens. This significantly amplifies the impact of any code execution or credential theft vulnerability in insights-client (e.g., CVE-2026-71474, CVE-2026-71845).

The production ClusterRole should be scoped to the minimum required: get on the specific Secret openshift-config/pull-secret in the openshift-config namespace, rather than cluster-wide secrets access.

Upstream: stolostron/insights-client
Note You need to log in before you can comment on or make changes to this bug.