CVE-2026-71846: redhat advanced_cluster_management_for_kubernetes Execution with Unnecessary Privileges

Vulnerability summary

CVE-2026-71846 is a medium (CVSS 6.5) Execution with Unnecessary Privileges vulnerability in redhat advanced_cluster_management_for_kubernetes. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.8% of scored vulnerabilities.

Timeline

1. 12-08-2026
   PublishedVulnerability first disclosed.
2. 05-09-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.

• CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.