CVE-2026-93017 — The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or …
Description
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```
CVSS v3.1 base metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NHigh severity
Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.
AV
Network
Attack Vector
AC
Low
Attack Complexity
PR
Low
Privileges Required
UI
None
User Interaction
S
Changed
Scope
C
High
Confidentiality
I
None
Integrity
A
None
Availability
References
Related threats
same CWE or vendorCVE-2026-84245 — IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component.
CVE-2026-84245 · 2h ago
CVE-2026-50054 — An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant anothe…
CVE-2026-50054 · 5h ago
CVE-2026-107510 — An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.
CVE-2026-107510 · 12h ago
CVE-2026-103692 — The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated user…
CVE-2026-103692 · 16h ago
CVE-2026-94578 — Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) in…
CVE-2026-94578 · 19h ago
CVE-2026-87681 — An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1.
CVE-2026-87681 · 21h ago