CVE-2026-93017
Received Received - Intake

Privilege Escalation via Secrets Access in Insights Operator

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: redhat-SADP

Description
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-93017
EUVD
EUVD-2026-95030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat insights-operator *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-93017 is a privilege escalation vulnerability in the OpenShift insights-operator. The insights-operator-gather ClusterRole grants the gather ServiceAccount cluster-wide read access to all secrets in the core API group without namespace or resource name restrictions. This excessive permission allows any pod spawned with the gather service account to access every secret across all namespaces, including sensitive data like credentials and TLS certificates.

Detection Guidance

Check for pods using the gather service account in the openshift-insights namespace with commands like: kubectl get pods -n openshift-insights --field-selector=spec.serviceAccountName=gather. Review ClusterRole bindings for excessive secret access using: kubectl get clusterrolebindings -o yaml | grep -A 10 insights-operator-gather.

Impact Analysis

An attacker who gains the ability to create a pod in the openshift-insights namespace could exploit this over-permissive RBAC to read all cluster secrets. This could lead to unauthorized access to sensitive information such as credentials, API keys, and certificates across the entire cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict control over personal or health information. Unauthorized secret access may result in data breaches, triggering legal penalties and reputational damage.

Mitigation Strategies

Remove unnecessary secret access from the insights-operator-gather ClusterRole by restricting resourceNames or limiting verbs to only what is required. Monitor for unauthorized pods using the gather service account and revoke excessive permissions immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93017. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart