Skip to content
Fencer Vulns
high 7.7

CVE-2026-93017 json

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

published 2026-10-08 31 d ago modified 2026-10-30 10 d ago also EUVD-2026-95030

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.

Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ```

By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.

``` spec: serviceAccountName:"gather" ```

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.12 1792974936
  • Red Hat Red Hat OpenShift Container Platform 4.14 1791842870
  • Red Hat Red Hat OpenShift Container Platform 4.15 1791632611
  • Red Hat Red Hat OpenShift Container Platform 4.16 1792879727
  • Red Hat Red Hat OpenShift Container Platform 4.18 1792874579
  • Red Hat Red Hat OpenShift Container Platform 4.19 1791626249
  • Red Hat Red Hat OpenShift Container Platform 4.20 1791625576
  • Red Hat Red Hat OpenShift Container Platform 4.21 1791980436
  • Red Hat Red Hat OpenShift Container Platform 4.22 1792771251

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-93017 updated cvss 7.7

insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader

  • Red Hat OpenShift Container Platform 5 openshift5/ose-insights-rhel9-operator
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-insights-rhel8-operator 1792974936
    fixed: vendor fix RHSA-2026:90274
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-insights-rhel8-operator 1791842870
    fixed: vendor fix RHSA-2026:82785
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-insights-rhel9-operator 1791632611
    fixed: vendor fix RHSA-2026:82813
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-insights-rhel9-operator 1792879727
    fixed: vendor fix RHSA-2026:89715
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-insights-rhel9-operator 1792874579
    fixed: vendor fix RHSA-2026:89726
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-insights-rhel9-operator 1791626249
    fixed: vendor fix RHSA-2026:83480
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-insights-rhel9-operator 1791625576
    fixed: vendor fix RHSA-2026:83502
show 3 more
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-insights-rhel9-operator 1791980436
    fixed: vendor fix RHSA-2026:83702
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-insights-rhel9-operator 1792771251
    fixed: vendor fix RHSA-2026:89198
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cli 1792978815, openshift4/ose-pod 1792975145, openshift4/ose-etcd 1792974936, openshift4/ose-tests 1792891850, openshift4/ose-console 1792976642, openshift4/ose-coredns 1792977034, +183 more Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1791838793, openshift4/ose-pod 1791842699, openshift4/ose-tests 1791781968, openshift4/ose-console 1791842061, openshift4/ose-coredns 1791842976, openshift4/ose-deployer 1791843620, +189 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1791878476, openshift4/ose-tests 1791889482, openshift4/ose-console 1791836468, openshift4/ose-deployer 1791888334, openshift4/ose-installer 1791889788, openshift4/ose-pod-rhel9 1791639781, +184 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1792881772, openshift4/ose-pod-rhel9 1792881268, openshift4/ose-sdn-rhel9 1792891515, openshift4/ose-etcd-rhel9 1792884751, openshift4/ose-tests-rhel9 1792892635, openshift4/ose-tools-rhel9 1792881835, +182 more Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1792871696, openshift4/ose-cli-rhel9 1792872369, openshift4/ose-pod-rhel9 1792874059, openshift4/ose-etcd-rhel9 1792872802, openshift4/ose-tests-rhel9 1792875197, openshift4/ose-tools-rhel9 1792872836, +180 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1791562405, openshift4/ose-cli-rhel9 1791599168, openshift4/ose-pod-rhel9 1791596107, openshift4/ose-etcd-rhel9 1791569256, openshift4/ose-tests-rhel9 1791925737, openshift4/ose-tools-rhel9 1791587725, +180 more
    +3 more products
    Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1791850018, openshift4/ose-cli-rhel9 1791569620, openshift4/ose-pod-rhel9 1791625568, openshift4/ose-etcd-rhel9 1791578129, openshift4/ose-tests-rhel9 1791927171, openshift4/ose-tools-rhel9 1791779009, +182 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1792074776, openshift4/ose-cli-rhel9 1791978373, openshift4/ose-pod-rhel9 1791994367, openshift4/ose-etcd-rhel9 1791978549, openshift4/ose-tests-rhel9 1791991134, openshift4/ose-tools-rhel9 1791978846, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1792844305, openshift4/ose-cli-rhel9 1792854321, openshift4/ose-pod-rhel9 1792855800, openshift4/ose-etcd-rhel9 1792769386, openshift4/ose-tests-rhel9 1792844569, openshift4/ose-tools-rhel9 1792769417, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
30 d ago

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.