ACM must-gather: wrapper CRs embedding Secret data are collected unredacted into the support archive

Impact

Certain ACM wrapper custom resources embed Secret data, and must-gather collects them without redaction, so credentials and tokens land in cleartext inside the resulting archive. Support archives are handled far more loosely than the cluster they came from: they get attached to vendor tickets, dropped in object storage, and passed between teams, so the exposure is everyone who can read the file rather than everyone with cluster admin. On an ACM-managed fleet the embedded material can include hub-to-managed-cluster credentials and provider secrets, which is control over the GPU clusters ACM governs.

Who can reach it

Anyone who can read a must-gather archive produced by an affected ACM version — ticket systems, shared drives, storage buckets. Generating the archive requires a cluster user with must-gather rights.

What to do

The record names no fixed ACM version; track Red Hat's page for CVE-2026-73834 for the errata. In the meantime treat every must-gather archive from an affected ACM as secret material: audit where past archives were sent, and rotate the credentials carried in the affected wrapper CRs. No node maintenance is involved.

References