ACM must-gather: cluster Proxy object dumped raw, exposing proxy basic-auth credentials

Impact

must-gather dumps the cluster Proxy object in raw form, bypassing the oc inspect redaction that normally sanitizes it, so the proxy's basic-auth credentials appear in cleartext in the archive. In an egress-controlled or air-gapped GPU environment the cluster proxy is often the single sanctioned path off the fleet, and its credentials let whoever holds them route traffic outbound as the cluster. Like any support archive, the file travels: vendor cases, ticket attachments, shared buckets. Confidentiality only — nothing is modified by this flaw.

Who can reach it

Anyone with access to a must-gather archive collected from an affected ACM version. Producing the archive requires an authenticated cluster user with must-gather rights.

What to do

No fixed version appears in this record; follow Red Hat's page for CVE-2026-75485. Immediately, rotate the proxy basic-auth credentials if a must-gather archive left your control, and scrub existing archives before sharing. No node drain or reboot.

References