CVE-2026-71846 — MEDIUM (6.5)

Vulnerability Description

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Advanced Cluster Management For Kubernetes	2.0
Redhat	Insights-Client	-

Related Weaknesses (CWE)

CWE-250

References

FAQ

What is CVE-2026-71846?

CVE-2026-71846 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a s...

How severe is CVE-2026-71846?

CVE-2026-71846 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-71846?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Advanced Cluster Management For Kubernetes, Redhat Insights-Client.