Description
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.

Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373
```
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
```

By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.

```
spec:
serviceAccountName:"gather"
```
Published: 2026-10-08
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Cluster‑wide Secret Disclosure
Action: Patch Now
AI Analysis

Impact

The insights‑operator‑gather ClusterRole improperly grants its service account read access to all secrets in the core API group without any namespace or resource restriction. By creating a pod that uses this service account, an attacker can read the contents of any secret in any namespace, potentially exposing credentials, certificates, or other sensitive data. The weakness is a privilege management flaw (CWE‑269).

Affected Systems

Red Hat OpenShift Container Platform 4 is affected because the vulnerability resides in the insights‑operator ClusterRole bundled with this product. No specific patch release versions are listed, so the issue likely applies to all current 4.x releases until a fix is provided.

Risk and Exploitability

The CVSS score is 7.7, indicating a high severity impact. EPSS is not available, so the exploitation probability is unknown; however, the vulnerability is not currently listed in CISA KEV. The likely attack vector is via the ability to run a pod using the gather service account. If an attacker can create pods or has privileges to bind the service account to a pod, they can exploit this misconfiguration to read cluster‑wide secrets.

Generated by OpenCVE AI on October 8, 2026 at 17:21 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply the latest Red Hat OpenShift Container Platform update that addresses CVE‑2026‑93017.
  • Restrict the gather ServiceAccount by modifying its ClusterRole to remove cluster‑wide secrets read permissions or limit the access to a specific namespace.
  • If the gather ServiceAccount is unnecessary, delete its ServiceRoleBinding or set its permissions to the minimum required for normal operations.
  • Audit existing ClusterRoleBindings and remove any that provide the gather ServiceAccount with broader privileges than needed.
  • Consider implementing namespace isolation or network policies to prevent unintended pod binding to the gather ServiceAccount.

Generated by OpenCVE AI on October 8, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift:4.14::el9
cpe:/a:redhat:openshift:4.15::el9
References

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
References

Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.20::el9
cpe:/a:redhat:openshift:4.21::el9
References

Sat, 10 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Vendors & Products Redhat openshift Container Platform

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 08 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```
Title Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
First Time appeared Redhat
Redhat openshift
Weaknesses CWE-269
CPEs cpe:/a:redhat:openshift:4
Vendors & Products Redhat
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Redhat Openshift Openshift Container Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-23T05:09:29.279Z

Reserved: 2026-09-17T14:51:36.301Z

Link: CVE-2026-93017

cve-icon Vulnrichment

Updated: 2026-10-10T03:09:22.899Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-08T15:17:56.950

Modified: 2026-10-23T06:17:07.863

Link: CVE-2026-93017

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-08T13:27:52Z

Links: CVE-2026-93017 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T07:15:09Z

Weaknesses
  • CWE-269

    Improper Privilege Management