CVE-2026-73834

Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.

Analysis

AI-generated

Technical impact

A flaw in the must‑gather component of Red Hat Advanced Cluster Management for Kubernetes causes ACM wrapper Custom Resources that embed Secret data to be collected without redaction. When an administrator executes must‑gather, the resulting archive contains credentials and tokens in cleartext, allowing anyone who can read the archive to obtain sensitive authentication information. This can lead to unauthorized disclosure of authentication data.

Affected Systems

The vulnerability is limited to Red Hat Advanced Cluster Management for Kubernetes 2, the product identified by the CNA as affected.

Risk and Exploitability

The CVSS score of 5.5 indicates a medium impact. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so widespread exploitation is not yet documented. The likely attack vector is an authenticated user who can run must‑gather; if the produced archive is stored or transferred, an attacker who can access it can read the exposed credentials. Because the flaw manifests during normal use of must‑gather, the risk is moderate but non‑zero.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Restrict the execution of must‑gather to a limited set of trusted administrators and roles
  • Store and handle must‑gather archives in a secure location with strict access controls
  • Perform regular audits of must‑gather archives to detect embedded credentials or tokens
  • Consider disabling the collection of ACM wrapper Custom Resources that contain secrets if the feature can be turned off
  • Monitor cluster activity for unusual must‑gather usage as a potential intrusion indicator
  • CNA workaround: mitigation is not available or options do not meet criteria

Generated by OpenCVE AI on August 18, 2026 at 18:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Description A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.
Title Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
First Time appeared Redhat
Redhat acm
Weaknesses CWE-312
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-312

    Cleartext Storage of Sensitive Information

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Sep 5, 2026, 5:08 PM
Reserved
Aug 18, 2026, 2:31 PM

View source JSON

Updated
Aug 20, 2026, 2:08 PM

JSON

Status
Awaiting Analysis
Published
Aug 18, 2026, 4:18 PM
Modified
Sep 5, 2026, 6:17 PM

View source JSON

Severity
Moderate
Public date
Aug 18, 2026, 2:30 PM

View source Bugzilla JSON

Updated
Aug 18, 2026, 9:15 PM

JSON