CVE-2026-93017

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

State: Published
Severity: 7.7 High
Published: Oct 8, 2026
Updated: Oct 30, 2026
Reserved: Sep 17, 2026

Description

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.

Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ```

By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.

``` spec: serviceAccountName:"gather" ```

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	redhat

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
Red Hat OpenShift Container Platform 4.12Red Hat	1792974936 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	1791842870 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	1791632611 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	1792879727 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	1792874579 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	1791626249 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	1791625576 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat	1791980436 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	1792771251 and laterNot affected
Red Hat OpenShift Container Platform 5Red Hat

References

RHSA-2026:82785vendor-advisory
RHSA-2026:82813vendor-advisory
RHSA-2026:83480vendor-advisory
RHSA-2026:83502vendor-advisory
RHSA-2026:83702vendor-advisory
RHSA-2026:89198vendor-advisory
RHSA-2026:89715vendor-advisory
RHSA-2026:89726vendor-advisory
RHSA-2026:90274vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-93017vdb-entry
RHBZ#2515741issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.