Description
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.
Published: 2026-08-18
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is in the must‑gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is written to the must‑gather archive in raw form, bypassing the oc inspect redaction that would normally remove sensitive fields. As a result, proxy basic‑auth credentials are captured in the archive and could be viewed by anyone who has access to it. This flaw falls under CWE‑532 – Information Exposure through insecure storage.

Affected Systems

Red Hat Advanced Cluster Management for Kubernetes version 2 is affected. Only this product and version are listed as impacted in the CNA data.

Risk and Exploitability

The CVSS score of 5.5 indicates a medium impact. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is indirect; an adversary who gains access to the must‑gather archive—whether through mis‑configured access controls or after a cluster compromise—can read the exposed credentials. Due to the potential credential theft, the risk is considered moderate, especially when archives are shared with external parties.

Generated by OpenCVE AI on August 18, 2026 at 16:34 UTC.

Remediation

Vendor Workaround

To mitigate the risk of credential exposure, restrict access to must-gather archives to authorized personnel only. Before sharing must-gather archives, especially with external entities, manually inspect and redact any sensitive information, including proxy basic-auth credentials, from the `cluster Proxy object` within the archive.

OpenCVE Recommended Actions

  • Restrict access to must‑gather archives to authorized personnel only
  • Manually inspect and redact any sensitive information, including proxy basic‑auth credentials, from the cluster Proxy object within the archive before sharing
  • Implement secure transmission and access‑logging controls when distributing must‑gather archives to limit exposure

Generated by OpenCVE AI on August 18, 2026 at 16:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Title Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials Must-gather: /tmp/kubeconfig retention

Thu, 27 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References

Wed, 26 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 18 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.
Title Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials
First Time appeared Redhat
Redhat acm
Weaknesses CWE-532
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-05T17:08:39.455Z

Reserved: 2026-08-18T14:31:50.308Z

Link: CVE-2026-75485

cve-icon Vulnrichment

Updated: 2026-08-18T15:34:58.321Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-18T16:18:20.743

Modified: 2026-09-05T18:17:28.897

Link: CVE-2026-75485

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-18T14:30:00Z

Links: CVE-2026-75485 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:18:38Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File