What’s Vulnerable › Vulnerabilities
CVE-2026-93017: Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
- Severity: high (CVSS 7.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-08 · updated 2026-10-30
- Weakness: CWE-269
Description
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```
Affected products
- Red Hat OpenShift Container Platform 4.18: all versions — fixed in 1792874579
- Red Hat OpenShift Container Platform 4.12: all versions — fixed in 1792974936
- Red Hat OpenShift Container Platform 4.14: all versions — fixed in 1791842870
- Red Hat OpenShift Container Platform 4.15: all versions — fixed in 1791632611
- Red Hat OpenShift Container Platform 4.16: all versions — fixed in 1792879727
- Red Hat OpenShift Container Platform 4.19: all versions — fixed in 1791626249
- Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1791625576
- Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1791980436
- Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1792771251
- Red Hat OpenShift Container Platform 5: all versions
How to fix
Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 1792874579; Red Hat OpenShift Container Platform 4.12 1792974936; Red Hat OpenShift Container Platform 4.14 1791842870; Red Hat OpenShift Container Platform 4.15 1791632611; Red Hat OpenShift Container Platform 4.16 1792879727; Red Hat OpenShift Container Platform 4.19 1791626249; Red Hat OpenShift Container Platform 4.20 1791625576; Red Hat OpenShift Container Platform 4.21 1791980436; Red Hat OpenShift Container Platform 4.22 1792771251. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2026:82785
- https://access.redhat.com/errata/RHSA-2026:82813
- https://access.redhat.com/errata/RHSA-2026:83480
- https://access.redhat.com/errata/RHSA-2026:83502
- https://access.redhat.com/errata/RHSA-2026:83702
- https://access.redhat.com/errata/RHSA-2026:89198
- https://access.redhat.com/errata/RHSA-2026:89715
- https://access.redhat.com/errata/RHSA-2026:89726
- https://access.redhat.com/errata/RHSA-2026:90274
- https://access.redhat.com/security/cve/CVE-2026-93017
- https://bugzilla.redhat.com/show_bug.cgi?id=2515741
Get alerted when CVE-2026-93017 or the next vulnerability affects your stack