Database/Container, Kubernetes & orchestration
ACM must-gather: wrapper CRs embedding Secret data are collected unredacted into the support archive
Impact
Certain ACM wrapper custom resources embed Secret data, and must-gather collects them without redaction, so credentials and tokens land in cleartext inside the resulting archive. Support archives are handled far more loosely than the cluster they came from: they get attached to vendor tickets, dropped in object storage, and passed between teams, so the exposure is everyone who can read the file rather than everyone with cluster admin. On an ACM-managed fleet the embedded material can include hub-to-managed-cluster credentials and provider secrets, which is control over the GPU clusters ACM governs.
Who can reach it
Anyone who can read a must-gather archive produced by an affected ACM version — ticket systems, shared drives, storage buckets. Generating the archive requires a cluster user with must-gather rights.
What to do
The record names no fixed ACM version; track Red Hat's page for CVE-2026-73834 for the errata. In the meantime treat every must-gather archive from an affected ACM as secret material: audit where past archives were sent, and rotate the credentials carried in the affected wrapper CRs. No node maintenance is involved.
References
Related entries
- ACM must-gather: cluster Proxy object dumped raw, exposing proxy basic-auth credentialsCVE-2026-75485 · Red Hat Advanced Cluster Management must-gather (cluster Proxy object collection)Medium
- runc (linux.resources.devices cgroup list handling): MULTI-TENANT DEVICE ISOLATION: runc implemented theNCVD-2020-005-runc-linux-resources-devices-cgr · runc (linux.resources.devices cgroup list handling)Medium
- etcd (write-ahead log, user authentication entries): CONTROL-PLANE CREDENTIALS AT REST IN CLEARTEXT: etcd writes theNCVD-2020-006-etcd-write-ahead-log-user-authen · etcd (write-ahead log, user authentication entries)Medium
- containerd (default mounts, /sys/devices/virtual/powercap RAPL): Containers get read access to Intel RAPL powerNCVD-2023-009-containerd-default-mounts-sys-de · containerd (default mounts, /sys/devices/virtual/powercap RAPL)Medium
- Kubernetes (kubelet/kube-proxy): Node's 127.0.0.1-bound services reachable from adjacent hosts and podsCVE-2020-8558 · Kubernetes (kubelet/kube-proxy)Medium
- Cilium: Ingress NetworkPolicies not enforced for pod traffic to L7 servicesCVE-2026-33726 · CiliumMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.