Vulnerability Details CVE-2026-71846
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 1.4%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-71846
-
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0
-
cpe:2.3:a:redhat:insights-client:-