CVE-2026-73834
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In the must-gather component of Red Hat Advanced Cluster Management for Kubernetes, certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.
Risk Assessment
Access to the must-gather archive may expose credentials and tokens, potentially leading to unauthorized access to cluster resources.
Recommendation
Apply patches from Red Hat for must-gather and ensure archives are stored with restricted access.
Original NVD description (English source)
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.