{"id":"CVE-2026-93017","published":"2026-10-08T15:17:56.950","lastModified":"2026-10-10T04:18:19.450","description":"The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n  - \"\"\n  resources:\n  - secrets\n  verbs:\n  - get\n  - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93017","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515741","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The insights-operator-gather ClusterRole grants excessive read permissions on all secrets across all namespaces without any restrictions. This allows an attacker who can spawn a pod using this service account to access every secret in the cluster, potentially exposing sensitive credentials and configuration data.","exploitability":"Exploitation is moderately easy requiring only the ability to create a pod with the gather service account, with no additional prerequisites needed.","blast_radius":"The impact could be severe as attackers would gain access to all secrets including database credentials, API tokens, and other sensitive configuration data across all namespaces.","remediation":"Restrict the ClusterRole to specific namespaces or resource names by adding 'namespace' and/or 'resourceNames' restrictions to limit secret access to only necessary resources.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","secret-exfiltration","rbac"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:22:53.742Z"}}