CVE-2026-93017
The `insights-operator-gather` ClusterRole grants the operator's service account read access to…
- Risk score
- 50/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
- https://access.redhat.com/errata/RHSA-2026:82785
- https://access.redhat.com/errata/RHSA-2026:82813
- https://access.redhat.com/errata/RHSA-2026:83480
- https://access.redhat.com/errata/RHSA-2026:83502
- https://access.redhat.com/errata/RHSA-2026:83702
- https://access.redhat.com/security/cve/CVE-2026-93017
- https://bugzilla.redhat.com/show_bug.cgi?id=2515741
Original description
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```
Last activity 8 Oct 2026. Patch Forecast updates every hour.