Database/Container, Kubernetes & orchestration
ACM must-gather: cluster Proxy object dumped raw, exposing proxy basic-auth credentials
Impact
must-gather dumps the cluster Proxy object in raw form, bypassing the oc inspect redaction that normally sanitizes it, so the proxy's basic-auth credentials appear in cleartext in the archive. In an egress-controlled or air-gapped GPU environment the cluster proxy is often the single sanctioned path off the fleet, and its credentials let whoever holds them route traffic outbound as the cluster. Like any support archive, the file travels: vendor cases, ticket attachments, shared buckets. Confidentiality only — nothing is modified by this flaw.
Who can reach it
Anyone with access to a must-gather archive collected from an affected ACM version. Producing the archive requires an authenticated cluster user with must-gather rights.
What to do
No fixed version appears in this record; follow Red Hat's page for CVE-2026-75485. Immediately, rotate the proxy basic-auth credentials if a must-gather archive left your control, and scrub existing archives before sharing. No node drain or reboot.
References
Related entries
- runc (linux.resources.devices cgroup list handling): MULTI-TENANT DEVICE ISOLATION: runc implemented theNCVD-2020-005-runc-linux-resources-devices-cgr · runc (linux.resources.devices cgroup list handling)Medium
- etcd (write-ahead log, user authentication entries): CONTROL-PLANE CREDENTIALS AT REST IN CLEARTEXT: etcd writes theNCVD-2020-006-etcd-write-ahead-log-user-authen · etcd (write-ahead log, user authentication entries)Medium
- containerd (default mounts, /sys/devices/virtual/powercap RAPL): Containers get read access to Intel RAPL powerNCVD-2023-009-containerd-default-mounts-sys-de · containerd (default mounts, /sys/devices/virtual/powercap RAPL)Medium
- Kubernetes (kubelet/kube-proxy): Node's 127.0.0.1-bound services reachable from adjacent hosts and podsCVE-2020-8558 · Kubernetes (kubelet/kube-proxy)Medium
- Cilium: Ingress NetworkPolicies not enforced for pod traffic to L7 servicesCVE-2026-33726 · CiliumMedium
- Istio: serviceAccounts and notServiceAccounts in AuthorizationPolicy are evaluated incorrectlyCVE-2026-39350 · IstioMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.