CVE-2026-71846

Received Received - Intake

Excessive Privilege in insights-client ClusterRole

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Red Hat, Inc.

Description

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-71846

EUVD

EUVD-2026-57688

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	insights-client	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-250	The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

Executive Summary

This vulnerability is in the insights-client component. It grants the ServiceAccount cluster-wide permissions to access secrets, but the code only needs access to a single secret. This excessive privilege allows an attacker who compromises the insights-client pod or token to read all secrets across the cluster, including sensitive credentials.

Detection Guidance

To detect this vulnerability, check if the insights-client ServiceAccount has excessive permissions by inspecting its ClusterRole bindings. Use commands like 'kubectl get clusterrolebindings -A' to list bindings and 'kubectl describe clusterrole <role-name>' to review permissions. Verify if the role grants secrets get, list, or watch cluster-wide.

Impact Analysis

If exploited, this flaw could let an attacker access all secrets in the cluster, including managed-cluster kubeconfigs and other sensitive credentials. This could lead to unauthorized access, data breaches, or further attacks within the environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, legal penalties, and reputational damage.

Mitigation Strategies

Review the ServiceAccount and ClusterRole bindings for insights-client to ensure least privilege. Restrict the ClusterRole to only the required Secret access. Rotate any exposed credentials and monitor for unauthorized access.

Hi! I’m here to help you understand CVE-2026-71846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70