{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93017", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-17T14:51:36.301Z", "datePublished": "2026-10-08T14:31:58.671Z", "dateUpdated": "2026-10-23T05:09:29.279Z"}, "containers": {"cna": {"title": "Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction \u2014 therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```"}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-insights-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "1791842870", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-insights-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1791632611", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-insights-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1791626249", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-insights-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1791625576", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.20::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-insights-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1791980436", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.21::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:82785", "name": "RHSA-2026:82785", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82813", "name": "RHSA-2026:82813", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:83480", "name": "RHSA-2026:83480", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:83502", "name": "RHSA-2026:83502", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:83702", "name": "RHSA-2026:83702", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-93017", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515741", "name": "RHBZ#2515741", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-08T13:27:52.755Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-269: Improper Privilege Management", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-06-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-08T13:27:52.755Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-23T05:09:29.279Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-10T03:09:17.420970Z", "id": "CVE-2026-93017", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-10T03:09:27.425Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93017", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-10T03:09:17.420970Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-10T03:09:22.899Z"}}], "cna": {"title": "Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "1791842870", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-insights-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "1791632611", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-insights-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "1791626249", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-insights-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "versions": [{"status": "unaffected", "version": "1791625576", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-insights-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "versions": [{"status": "unaffected", "version": "1791980436", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-insights-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-06-09T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-08T13:27:52.755Z", "value": "Made public."}], "datePublic": "2026-10-08T13:27:52.755Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:82785", "name": "RHSA-2026:82785", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82813", "name": "RHSA-2026:82813", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:83480", "name": "RHSA-2026:83480", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:83502", "name": "RHSA-2026:83502", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:83702", "name": "RHSA-2026:83702", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-93017", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515741", "name": "RHBZ#2515741", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction \u2014 therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "Improper Privilege Management"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-23T05:09:29.279Z"}, "x_redhatCweChain": "CWE-269: Improper Privilege Management"}}, "cveMetadata": {"cveId": "CVE-2026-93017", "state": "PUBLISHED", "dateUpdated": "2026-10-23T05:09:29.279Z", "dateReserved": "2026-09-17T14:51:36.301Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-08T14:31:58.671Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-insights-rhel8-operator", "product": "Red Hat OpenShift Container Platform 4.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791842870", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-insights-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791632611", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-insights-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791626249", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-insights-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791625576", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-insights-rhel9-operator", "product": "Red Hat OpenShift Container Platform 4.21", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791980436", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction \u2014 therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```"}], "id": "CVE-2026-93017", "lastModified": "2026-10-23T06:17:07.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93017", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-10T03:09:17.420970Z", "version": "2.0.3"}}]}, "published": "2026-10-08T15:17:56.950", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:82785"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:82813"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:83480"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:83502"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:83702"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-93017"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515741"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader", "id": "2515741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515741"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-269", "details": ["The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction \u2014 therefore, access to every secret in every namespace in the cluster.\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n- \"\"\nresources:\n- secrets\nverbs:\n- get\n- list\n```\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n```\nspec:\nserviceAccountName:\"gather\"\n```"], "name": "CVE-2026-93017", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-insights-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-insights-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-08T13:27:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93017\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93017"], "statement": "A privilege escalation risk was found in the OpenShift insights-operator. The insights-operator-gather ClusterRole grants the operator's gather ServiceAccount cluster-wide get and list access to secrets in the core API group, with no namespace or resourceNames restriction. This means the ServiceAccount has read access to every secret in every namespace in the cluster. While the operator requires access to certain cluster data for telemetry collection, the scope of secret access exceeds what is necessary for its intended function.\nAn attacker who gains the ability to create a pod using the gather ServiceAccount in the openshift-insights namespace could leverage this over-permissive RBAC to read all cluster secrets, including credentials, TLS certificates, and other sensitive data.", "threat_severity": "Important"}