{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93017", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-17T14:51:36.301Z", "datePublished": "2026-10-08T14:31:58.671Z", "dateUpdated": "2026-10-08T14:31:58.671Z"}, "containers": {"cna": {"title": "Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction \u2014 therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```"}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/ose-insights-rhel8-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/ose-insights-rhel9-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-93017", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515741", "name": "RHBZ#2515741", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-08T13:27:52.755Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-269: Improper Privilege Management", "timeline": [{"lang": "en", "time": "2026-06-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-08T13:27:52.755Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-08T14:31:58.671Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift4/ose-insights-rhel8-operator", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift4/ose-insights-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction \u2014 therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```"}], "id": "CVE-2026-93017", "lastModified": "2026-10-08T20:49:23.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "secalert@redhat.com", "type": "Primary"}]}, "published": "2026-10-08T15:17:56.950", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-93017"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515741"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"bugzilla": {"description": "insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader", "id": "2515741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515741"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-269", "details": ["The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction \u2014 therefore, access to every secret in every namespace in the cluster.\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n- \"\"\nresources:\n- secrets\nverbs:\n- get\n- list\n```\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n```\nspec:\nserviceAccountName:\"gather\"\n```"], "name": "CVE-2026-93017", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-insights-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-insights-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-08T13:27:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93017\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93017"], "statement": "A privilege escalation risk was found in the OpenShift insights-operator. The insights-operator-gather ClusterRole grants the operator's gather ServiceAccount cluster-wide get and list access to secrets in the core API group, with no namespace or resourceNames restriction. This means the ServiceAccount has read access to every secret in every namespace in the cluster. While the operator requires access to certain cluster data for telemetry collection, the scope of secret access exceeds what is necessary for its intended function.\nAn attacker who gains the ability to create a pod using the gather ServiceAccount in the openshift-insights namespace could leverage this over-permissive RBAC to read all cluster secrets, including credentials, TLS certificates, and other sensitive data.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "openshift", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 86.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Container Platform 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_container_platform", "vendor": "redhat"}], "created": "2026-10-08T17:30:17.126861+00:00", "updated": "2026-10-09T07:15:09.070107+00:00", "vendors": ["redhat", "redhat$PRODUCT$openshift", "redhat$PRODUCT$openshift_container_platform"]}