The vulnerability arises when ACM/MCE's assisted-service writes the raw referenced pull-secret contents into the status field of an InfraEnv object after a pull-secret validation failure. This leakage discloses the pull-secret's .dockerconfigjson data, including username, password, email, and auth fields, to any namespace principal with the standard view ClusterRole. The underlying weakness is an unintended information disclosure (CWE‑201).

Affected product is Red Hat Multi‑Cluster Engine for Kubernetes. The CVE references only the product; no specific version information is listed in the CNA entry. Red Hat maintainers have acknowledged the issue in their advisory for the affected cluster distribution. All deployments using the default assisted-service component are potentially impacted until the vendor releases a fix.

The CVSS base score is 6.3, indicating a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the view role: a user cannot read Secrets directly but can read an InfraEnv object; the status message reveals the pull-secret fields. Attackers who can assign or are granted the view role, or who have compromised an account with that role, can obtain credentials for registry access. Because the vulnerability does not require privileged access, it poses a moderate but non‑negligible risk for installations where view users are broadly delegated.