CVE-2026-93017

Summary

The insights-operator-gather ClusterRole grants excessive read permissions on all secrets across all namespaces without any restrictions. This allows an attacker who can spawn a pod using this service account to access every secret in the cluster, potentially exposing sensitive credentials and configuration data.

Exploitability

Exploitation is moderately easy requiring only the ability to create a pod with the gather service account, with no additional prerequisites needed.

Blast radius

The impact could be severe as attackers would gain access to all secrets including database credentials, API tokens, and other sensitive configuration data across all namespaces.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Restrict the ClusterRole to specific namespaces or resource names by adding 'namespace' and/or 'resourceNames' restrictions to limit secret access to only necessary resources.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.