Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
OpenShift 4 carries CVE-2026-93017 at 7.7 CVSS. The insights-operator-gather account can read every secret cluster-wide. Spawn a pod with that service account and the data is exposed. https://thecircuitry.to/article/red-hat-openshift-4-hit-by-cve-2026-93017-with-77-cvss-score-muzwey3l https://t.co/NXxpY0yCm4